Support NullUser pattern as well as AnonymousUser pattern.

Allows `Authority.configuration.user_method` to return nil without raising `undefined method 'can_#{action}?' for nil:NilClass`, but `SecurityViolation` instead.

This works well for lightweight authentication systems that don't mock out a user when unauthenticated.

I meant for this to be a one-liner fix, but my text editor must have trimmed off a trailing space somewhere. Darn.