Adding in a factory method for creating the User Token

Broke the UsernamePasswordToken creation out into a separate overridable method
that just needs to return a TokenInterface object
It might be worth adding an accessor method for $firewall to compliment this addition. Otherwise any extending classes will not be able to access.