(CDAP-355) Insecurely pass user id from router to downstream services

This insecurely sets the user id received in the headers as a `ThreadLocal` in `SecurityRequestContext`.

`AuthenticationChannelHandler` is added as a channel pipeline modifier in `BaseNettyHttpServiceTemplate.get()` which all of our services have been changed to use instead of `NettyHttpService.builder()`.
based on the naming convention of constants, should this be called `ENABLED`?