Move validate_user to a separate service

Follow up change for the previous rbac/user validation changes.
Just move the validate_user stuff to a separate class.