Support Active Directory Domain Differentiation for usernames.

Current situation is:

The new User object now has a directory ID and is tied to a specific directory. However, the Crowd API amalgamates users across directories based on username, so you can (almost) never see a user that exists in a secondary directory with the same name as one in the first. So you can only log in as the user in the first directory.

Confluence internal code only processes 'username' in its API, and not specifically domain and username. Within the new user management code, users are identified by ID, which is unique for a user+domain.

The problem is that same usernames across different domains will lead to 'shadow user' issue.