[identity] Treat empty auth metadata as invalid CSAT

Summary:
ENG-9458.
Empty userID or deviceID makes DDB complain.

Test Plan: Called VerifyUserAccessToken RPC with empty user ID. The RPC errored before, now returns false.

Reviewers: varun, will

Reviewed By: varun

Subscribers: ashoat, tomek

Differential Revision: https://phab.comm.dev/D13558