Add preparation for provider (bug 942361)

can we call this user_id instead of user_hash? It's not really a hash and that would be insecure if it were. HMAC is computed more securely than a straight hash function.