But its unsafe to return null, it's much more reliable to return an User instance for anonymous. Deprecation is to notify this, since the methods are equivalent, but currentUser is safer.
About the thread, in this case it's better to return a new instance always, do you agree?