[FIXED SECURITY-243] Prefer resolving users by IDs first and foremost.

When looking up users we must always try to use the id first and fallback
to other methods only if this is unsucessful.