Improvements so that remote user can be obtained from reauth.

When logging into with a remote identity, the user ID might not be known
up front when initiating the authentication process. Allow the remote
identity service to declare the user ID with a first party caveat --
and require that a user ID is declared when reauthenticating to Juju.

The Admin.Login API call is getting pretty badly overloaded. Admin v1 methods
for obtaining a challenge macaroon and reauthenticating with it should
be separated out.