We should use openvswitch for routing headnode traffic

[gsilvis]

This can be done with the libvirt networking API. See 'Setting VLAN tag' at http://libvirt.org/formatnetwork.html . This makes getting rid of bridge preallocation easier in two ways. Since all these operations use only the libvirt API, they can be done without root privileges, and can be done remotely as well---meaning that the headnode host and the API server can be different machines. Because the VLAN-tagged networks are created with libvirt, they will persist after reboot.