Look up missing users from the auth backend when using submit-as.

submit-as was only accepting users who were already in the database.
Unlike other places where users are specified, such as during login or
target reviewers, the auth backends were never checked. We now loop
through the auth backends looping through a user if we can't find it in
the database.