Fix parent serialization of user object

Author: ddeboer

Authentication/Token/AbstractToken.php

@@ -146,7 +146,14 @@ public function eraseCredentials()
      */
     public function serialize()
     {
-        return serialize(array($this->user, $this->authenticated, $this->roles, $this->attributes));
+        return serialize(
+            array(
+                is_object($this->user) ? clone $this->user : $this->user,
+                $this->authenticated,
+                $this->roles,
+                $this->attributes
+            )
+        );
     }
 
     /**