Some users have no authenticationToken in database, but xml schema

says one must be there.

Made unofficial change on 2009-06-04 to allow minOccurs="0" for

this element.