How do online Nerve Gear games handle player authentication?
Your question can pretty much be answered by watching episode 1 of Sword Art Online.

The Nerve Gear uses a username and password identification system as shown at 01:37 of episode 1.



But as you mentioned, this does not occur in Alfheim Online. This is where we can consider the Nerve Gear to be the authentication factor, being a device that stores the save data.


   We know it can save data Yui's data was saved to his Nerve Gear and was transferred to Alfheim Online as a result.





  But if I steal your device, I could impersonate you in all games...


This would indeed be true, but doesn't the same count for login credentials? If you steal somebody's username and password, you can also impersonate that person in game. And don't forget, it's harder to steal physical objects all around the world than to steal some username and password from your home computer.