Add realm support

/to @ritch 
/cc @bajtos @dashby3000 

In this PR, we introduce `realm` to partition identities including users and/or applications to support the following use cases:

1. Users and applications belong to a single global realm (or no realm). This is what we have in LoopBack before the PR.
2. Users and applications are partitioned into multiple realms. Each user/application can only belong to one realm. Each realm can have many users/applications. In this case, realm is close to `organization`. We can introduce a Realm model if it has more metadata beyond just names.
3. Each application is basically a realm and each user belongs to an application. This could be used for mBaaS like parse.

The PR adds/enhances the `realm` property for application/user model. Each application or user still has a unique id across realms. When an application/user is signed up, it can be assigned to a realm. The user login function has been enhanced to support realms as follows:

1. Honor the realm property from the user credential
2. Allow the realm to be extracted from the prefix of username/email.
3. Relax the uniqueness check for username/email (ideally to be scoped within its realm, but it requires a juggler enhancement, will do it in a separate PR).
 
It still does not make sense to me. SDKs should add the `realm` property for the login method, that's not an sufficient argument to me.

As for login forms: you are saying that there will be a website that has the same login page for all realms and the user is expected to remember that he has to prepend a realm prefix to his email or username? That's a terrible user experience.

In my experience with multi-tenant applications, there is either:
 - a per-realm login URL (usually as a part of custom-themed per-realm website, e.g. http://strongloop.slack.com)
 - a login form that allows you to choose which realm you want to log into

There is also a third case where the email cannot be associated with more than one realm, e.g. Google Accounts works that way. However, my understanding is that we don't want to make emails globally unique.

I haven't seen a service where you as the user has to encode the realm into user credentials.