I'm concerned that this kills shared caching.  Before this change the cache was "global" and shared by all users. Now the cache is user-specific. It means we pay a price even when not using field level security. Let's try to only make user a part of the key for objects that actually use field level security.