origin and external_id columns

Temporary PR to review changes around origin and external_id columns.
Refactor of authz_approval to rely on user_id rather than username. 
Allowed origins - since all existing users are marked origin=unknown during the migration we don't know where the user was authenticated prior to the migration. For the UAA authentication manager the allowed origins will be 'uaa' and 'unknown'