Fix User serialization

`serialize` and `unserialize` MUST contain the fields used by the equals method and the username (and since e1f5b11ba77bb24f2d47054e7ea41e0ba8c1e2a2, the id) .
    
The equals method (implemented in [AbstractToken#hasUserChanged] (https://github.com/symfony/symfony/blob/master/src/Symfony/Component/Security/Core/Authentication/Token/AbstractToken.php#L237-280) since https://github.com/symfony/symfony/pull/2927) calls `isAccountNonExpired`and `isCredentialsNonExpired` which use `expiresAt` and `credentialsExpireAt`respectively.

These two attributes were missing from the serialization, preventing it from fulfilling its contract.

This PR also includes a phpdocs fix for `serialize` since the comment on the method had fallen far out of date over time.