I've been using a dedicated user account for 6 months now, and it does everything. What makes it great is the only axis of configuration is managing "what's hoisted into its accessible directories".

Its awe-inspiring the levels of complexity people will re-invent/bolt-on to achieve comparable (if not worse) results.