len() of users db not a good heuristic since deleting entries will cause uid collision. Refactored to use username as unique key. Also, added a xauth func to User to provide easy authentication if user object is available