Lockdown user model permissions

Since we add the `sys::authenticate` user to the service manager, can we then replace it with the user obtained from the document manager eg. Can we then just go:

```php
$user = $this->documentManager
              ->getRepository('Zoop\GomiModule\DataModel\User')
              ->findOneBy(['username' => 'toby']);

$this->shardServiceLocator->setService('user', $user);
```