Omniauth: Hide authentication fields for users with external source

This removes identity_url from safe_attributes and permitted_params
and prevents admins from setting it as we are using identity_url now
to identify users with an external authentication provider.