Implement a mapping layer between Shib and Drupal

Issue Summary

Shibboleth persistent id's are often unreadable or even invalid in Drupal sense. Therefore users might be presented a form, to define their own Drupal usernames on first login.

From the implementation POV, account linking is something very similar. An authenticated Drupal user can decide to link her account to federated login. After logging in, both the 'old' Drupal username and the 'new' persistent id are at hand, so account linking is done by adding a record to the mapping table.