The bootstrapped identity client can be used two ways:
- via client_credentials, it can create identity zones and create
clients in any identity zone
- on behalf of a user, it can clients.(read|write|admin) if a user is
part of those groups.

If a user has scope zones.<zone_id>.admin, and the user's request has a
header of X-Identity-Zone-Id: <zone_id>, the request will target that
zone, and the user will have thier other scopes applied to the request.

If a user or client has zones.admin, they will be able to do the above
in any identity zone