User creation no longer requires client auth

Client auth is now expected to be in the Authorization header.  If provided, ESDR will send email on behalf of the authenticated client.  If not provided, ESDR will send the email as itself.