Expose identity on AuthenticatedRequest

It is handy to be able to receive the `UserIdentity` object through `AuthenticatedRequest` instead of having to take it out of the request twice using `UserIdentity.fromRequestHeader`; once to check Auth and again if you need it.

This exposes `identity` so that `Actions` get access it in their block.

I have also thought about changing `AuthenticatedRequest.isAuthenticated` to `identity.exists(_.isValid)`, but I am unsure if the way it is done now was intentionally avoiding `UserIdentity.isValid`.