Steve, the developer of Deadbolt, suggested me the following:
the trick is to store the user in the context, and then have your controller or deadbolt handler to access it. This allows you to store the user by the actual class, and not have to use getSubject() and cast the resulting Subject to your actual User class.
So I decided to save the User object in the args-Field of Http.Context.current() and it works like a charm!