[api] allow to specify a user subaccount

* A user account can point to another user account.
* The subaccount is in state "subaccount". Permission checking follows
  to the other account to determine if is an active user.

Needed for accounts which are just used for automation. Disabling
the master account will also disable the alias accounts.