add user identity provisioning

@liggitt This builds on top of https://github.com/openshift/origin/pull/334, so I'll rebase it again once yours goes in, but I'm still looking for feedback.
The internal transformations to just use UserInfo on boundaries don't bother me as much as not knowing whether the thing you have needs persisting