origin and external_id columns

Temporary PR to review changes around origin and external_id columns.
Refactor of authz_approval to rely on user_id rather than username. 
The user_id MUST be part of the token