I would prefer ``protected`` for these variables and any private functions. someone might want to write a derivate plugin of the usermanager.