moved the security token service to user.xml
added user.xml and a participant provider service
participantprovider interface, implementation by using security token, and tests