Improve IUserValidator doc comments.

- IUserValidator.Validate can return null, meaning not authenticated / anonymous.
- Showed this in the demo.
Allow overriding of JSON deserialization length for unit testing.

- Made JavaScriptSerializer constructor public, allowing overriding of
  parameters.
- Allow using a different instance of JavaScriptSerializer in
  BrowserResponseBodyWrapperExtensions.DeserializeJson<TModel>().