Adding in a factory method for creating the User Token

Broke the UsernamePasswordToken creation out into a separate overridable method
that just needs to return a TokenInterface object