Err, stupid question, but in the version that should use injection, you did remove the User declaration here, did you:
User user = (User) em.createQuery(
Else you only ever set the value of the local var and there is nothing to outject.
No of course not, stupid me. Guess it was a bit to late yesterday.
And sorry for the low rating of your comment, I did not know that it was so ajaxified.