You should implement it as a separate layer.
Bitcoind doesn't really support multiple users. It lets you set a single username/password to connect to the RPC server, as well as encrypting the (single) wallet with a passphrase. But there's no way within bitcoind to have individual authentication credentials that will allow one to spend some of the coins in the wallet but not others.
So a typical way to do this would be to have bitcoind store all the coins of all the users, pooled in a single wallet. Then your software has to track how many coins belong to each user, authenticating the users, and ensuring that they can only spend those coins which are credited to them. (The accounts feature might have helped with the first of these, but not the others.)
Alternatively, you can run a separate bitcoind instance for each user, but this will require more resources.