Implement alternate root privileges

Addresses comments from a previous review
Leave configs in configs!
Cleaned up unit test, removed mock too

Implements: blueprint create-restricted-root-account

Change-Id: I43327c97c7b80dc99a2cfe071562d01f2d0f54a4