Engine: API: changes to support subscription-manager interactions

This commit contains several changes to support various
subscription-manager actions from a client.

e.g.
- subscription-manager
  - register/unregister
  - subscribe/unsubscribe/list
  - environments
  - organizations

When interacting with the client, there are scenarios where
the client cert is needed to support interfacing with backend
engines.  As a result, 'require_user' has been extended to
utilize that certificate in a manner similar to what was
previously done by warden.rb (i.e. pre-engine).
Merge pull request #3379 from bbuckingham/engine-systems

Engine: API: changes to support subscription-manager interactions