improve User. change setUsername() to private