The bootstrapped identity client is now only usable by users, and is
autoApproved. A user that has scope zones.create can use the identity
client to create IdentityZones. 
If a user has scope zones.<zone_id>.admin, and the user's request has a
header of X-Identity-Zone-Id: <zone_id>, the request will target that
zone, and the user will have thier other scopes applied to the request.