No more mosso (for testing)

Previously, we relied upon an old secret API (and a hack) for obtaining the ID of the user to impersonate for a tenant.  Due to some issues @kivattik ran into while testing against staging, it's possible that the hack will no longer work on the newer version of identity.

This uses the newer identity APIs (doc links coming in standup), and involves an extra call (maybe) per auth request.  :|  But is less hacky.

@kivattik Can you see whether this works vs. master works in staging?  That may help us figure out whether the setup is wrong or whether something has changed in the staging env.