Related: #7

This to enable the individual key handling needed for #7.

Partly addresses #3

This resolves #2

The problem runs deeper than this

This prevents name clashes with old user instances. This was usually a
problem when the upstream IdP changed the subjects of our users.

The flow from here on is: When a user logs in with a changed subject
a new user is created. The old user remains (but is not accessable by the
user).