NSA makes me paranoid ... try to get best supported cipher of the used browser and don't use RC4 at all
delete temporary uuid data structures.
remove specialized load and save from user, add serializable and indexable interface and make user utilize both and store a user and its credentials keyed by its uuid