Actually, if anything, that is the bug. We slightly changed our outlook on setting users inside services during development of XF 2.0. We tend to not allow it. You'll notice the majority of the setUser
methods are actually protected and only set internally, and this is by design.