[Security] added string representation for core Users

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | 
| License       | MIT
| Doc PR        | 

I often use type casting and `__toString()` to print my users as this lets me very easily keep one canonical format for their representation. In functional tests however, it is easier to use in-memory users but this defaults to instances of the core `User` object. Because these don't have a string representation all the nice type casting crashes.

Hence I propose to represent the core Users by their username string by default. It would be useful in a lot of cases and I can't see any harm in it?