Remove some authentication token stuffs

Since we don't have authentication token, I think there is no reason to check if password is "X".

:authentication_token don't have to be in the blacklist for serialization too.