A couple of things, that might help you out some.
When dealing with the security side of things, you are better of creating a service rather than a plugin. This service can then be added to the model that is defined in the config settings, and the wireBox mapping isn’t necessary when the files are placed into the relevant conventions. The only exception is when you need to send anything into the constructor at installation time, or use the configure to do the same when instantiated.
With what you currently have you are adding complexity when it is not needed.
The userService is not defined because it is not getting injected into the component. Now when you get the plugin, you only need to use the getMyPlugin() and not the instance, as this will then load the plugin as it is intended to be loaded and do all the wiring of dependencies.
Regards,
Andrew Scott
WebSite: http://www.andyscott.id.au/
Google+: http://plus.google.com/113032480415921517411