Ensure the anonymous principal is not authenticated

[StephenCWills]

Resolves an issue with the anti-CSRF token validator.

When generating a form token, the token validator uses IIdentity.IsAuthenticated to determine whether to encode a username in the token. Due to the changes in #363, the Login.cshtml page was encoding the username "anonymous" in its form token. When validating the form token for the AuthTest page, the validator was expecting an empty username.

GenericIdentity is authenticated so long as it has a name. Therefore, it is impossible to use GenericIdentity to get an identity with the name anonymous that is not authenticated. ClaimsIdentity is authenticated so long as it has an authentication type so we can simply pass a name claim with no authentication type into the constructor.