add user identity provisioning

@liggitt This builds on top of https://github.com/openshift/origin/pull/334, so I'll rebase it again once yours goes in, but I'm still looking for feedback.
You're still coupling user registry (a particular user implementation) with the oauth handlers.  The interface needs to be more generic - it should probably be in `auth/api`.