Use a concrete implementation of AuthenticationToken for !SYSTEM user

Using a concrete implementation of this class prevents collisions with user names (so we don't have to reserve "!SYSTEM"... not that many users would want that). It also simplifies things for developers on the server side, because we don't need a lot of custom code that diverges from the authentication API, for handling the !SYSTEM user.