Fixes #6726 - Actions that hit candlepin use username in cp-user oauth header

instead of remote_id