I'm wonder the pros and cons of passing in request instead of username, it will save whomever is using the User class the endless trouble of doing request.GET.get('REMOTE_USER'), 'anonymous') which is both, long and refactor unfriendly.

username can still be there as an optional third argument, just in the remote cases that in the future we have code where you need to edit someone else's userdata.