add user identity provisioning

@liggitt This builds on top of https://github.com/openshift/origin/pull/334, so I'll rebase it again once yours goes in, but I'm still looking for feedback.
The thing is this isn't a single project.  There are at least three levels of hierarchy here:

1. Base kubernetes (auth is abstracted)
2. Plugins (implementations that work together)
3. OpenShift potential implementation (above both)