(CDAP-355) Insecurely pass user id from router to downstream services

This insecurely sets the user id received in the headers as a `ThreadLocal` in `SecurityRequestContext`.

`AuthenticationChannelHandler` is added as a channel pipeline modifier in `BaseNettyHttpServiceTemplate.get()` which all of our services have been changed to use instead of `NettyHttpService.builder()`.
It seems pretty inconsistent with some have `CFG_` prefix, some doesn't. I think all the newly added one doesn't have `CFG_` prefix.