Add user to Run and do proper authentication.

Runs now have an owning user and uses can only see their own runs unless they
are administrators.

Service credentials are now only accessible by admins too.