Replace $REMOTE_USER with $http_x_forwarded_email

After digging deeper into the origin of $REMOTE_USER at Aidan Feldman's
request in 18F/hub#3, I realized that the user's entire email address was
available to nginx's Server Side Include module via the embedded
$http_x_forwarded_email variable, set by ngx_http_core_module:

http://nginx.org/en/docs/http/ngx_http_core_module.html#var_http_

Using this to create each directory under _site/auth seems preferable to
$REMOTE_USER, since having the domain name available as part of the generated
directory name may help to avoid conflicts, should we ever wish to grant
access to users from other domains.