[Security] Fix parent serialization of user object
bug #9806 [Security] Fix parent serialization of user object (ddeboer)

This PR was squashed before being merged into the 2.2 branch (closes #9806).

Discussion
----------

[Security] Fix parent serialization of user object

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        |

`parent::serialize()` and `parent::unserialize()`, which are used in the `AbstractToken` are [problematic](https://bugs.php.net/bug.php?id=62836) in PHP >= 5.4. [Cloning the object](https://gist.github.com/aurelijus/4713758) before serialization seems to fix this.

Commits
-------

2e4670d [Security] Fix parent serialization of user object