Fixes #6725 - Actions that hit candlepin use username in cp-user oauth header

instead of remote_id