There are two different implementations (in RC 1):
protected internal virtual ViewResult View(string viewName, string masterName, object model) {
protected internal virtual ViewResult View(IView view, object model) {
All the others call these two. However, I would not presume that this is going to stay this way forever. I would have to imagine that future releases of the framework might change this.
Update: To store user info, use ASP.NET membership. It already tells you if the user is logged in -- Request.IsAuthenticated. You can store custom permissions using normal Membership functions. Email properties and the like are already supported. And of course the authentication providers are pluggable, so you can use whatever kind of authentication you want -- Windows, domains, OpenID, etc.
Update 2: Note also that ControllerBase has a virtual Initialize method you can override to set up stuff you'll need later in various actions.