ACT-1941: prevent internal UserEntity class leaking though API

Simply test if the received User interface is castable to UserEntity and if not create a new one copying the fields over.