This should probably be using Object.prototype.hasOwnProperty.call to protect against same userids as functions on the object.