handle alias to svc of type externalName

- Don't swallow error returned by auth provider when looking up principal
- Return a 404 when principal not found by AD
- Return a 500 APIError for all non-404 error responses so that the user sees
a generic error message but a detailed error is logged

should use user cluster's k8s node client 

Use cluster display name in alert message

Fix logging issue

This is specifically for nodedriver activate/deactivate and the
config link on nodes. But, it lays the groundwork for general resource
method and action RBAC.