add user identity provisioning

@liggitt This builds on top of https://github.com/openshift/origin/pull/334, so I'll rebase it again once yours goes in, but I'm still looking for feedback.
@smarterclayton wanna ask here... isn't it more clear to have just:

```
type emptyPasswordAuth struct {
  userprovisioner.UserIdentityMappingProvisioner
}
```

?