Check user_id in request against credential store for OATH.

Since the HMAC key/AEAD isn't cryptographically bound to a specific user,
a check of the user id in the request against what is in the credential store
for this credential is necessary to prevent copy-paste attacks by an attacker
that can modify the user database.

It would have been preferred to not store the relationship between the user
and the credential in the credential store, but no really good alternative
could be thought of in the short term. All alternatives seems to involve
having the YubiHSM validate another AEAD or create a MAC of some sort, and
that would effectively double the load on what is thought to be the biggest
bottleneck.
Add file missing after refactoring.