auth-constraint based on username

 <auth-constraint role-name='ROLE-FOO'/> is cool, but can anyone think
of a way to do the same based on username, where all users are in the
same role? Its for a dir structure where I don't want users to see
each others folders.