Add support for lifetime constrained identities.

We don't support prompt constrained identities, as security
wise this is incompatible with the current X11 desktop. And
currently amounts to 'security theater'.