Admit that we don't own things

We're never going to own users or groups ... an ACL must take care of
the integration and translation with "directories" (ldap, active
directory).
- User: UserName was ditched in favor of a UserIdentifier
- UserGroup also got a UserGroupIdentifier instead of a name
- The names may come back (depends a bit on my evolving understanding)
- Minor renames along the way