Treat users with equal logins and servers as equal.

This would previously fail, because `-isEqual:` and `-hash` from `OCTObject` are all defined in terms of `objectID`.

That's fine for basically all other `OCTObject`s because they're always coming from the server which will give them their object ID. But users can be created in code as well.

I think relying on `login` and `server` should be legit for both the from-server and from-code cases, since the combination should be unique in both cases.