origin and external_id columns

Temporary PR to review changes around origin and external_id columns.
Refactor of authz_approval to rely on user_id rather than username.