Mp/authenticate endpoint feature parity

ping @opscode/server-team 

Update validation rules for requirements related to when external auth id is present. 

Note: there is still a gap here under erchef:  if external authentication is enabled for the user, we shouldn't require email address on update. However, erchef hasn't loaded the object at time of validation, and so if the field isn't present in the input, we don't know it's value.  Likely I'll need to tweak the validation to load the object. .