The authenticated_identifier field on cm_co_petitions should be changed/split out to record authenticated identifiers specifically for the petitioner and enrollee, following the same thing that was done for tokens when there is no authenticated identifier.