On login, look up username by OpenID identifier.

On login, first try to look up the username by OpenID identifier, using
get_user from branch tmp-non-ff-rewrite. Only create a (new) username if
the lookup fails.
Log creation of new user
Clean up username collision check.

We now look up usernames by their OpenID, so remove the redundant check
for a matching OpenID.
The check for collision with existing usernames and permission groups
remains.
Update documentation.