We will be having all users with origin=unknown. We can change those users to become origin=uaa when we authenticate them successfully.
This is the only safe way to make sure we mark the correct users with uaa, as we have no way of identifying their origin upon migration.