look for userid also, not only username (stealed from Netsight fork)
Better support for userid/username combination and let take care of readonly properties
Plone 3.3 compatibility