It sounds as if the real issue has to do with the main app. Are you desiging both a front-end and an initial startup in the same file? That may be where the confusion comes in.

This is very similar to what web application servers must doing during startup on a database, for instance, passing in a password for initial database startup. An application initialization script reads the config files and passes information to appropriate objects, which (usually) create and maintain pools of themselves, passing them to requesting objects. Avalon (in Java) has this kind of approach, and it's a good separation of concerns. Your front end app would simply request a User from a Factory, how it got populated (as you said), is none of it's concern.