I was just locking things down and just noticed /usr/local/cpanel/base/frontend/xcontroller is owned by the first user i created(which is me anyway so no biggie). Is this normal behavior?

Yes, this is normal.

Thanks much

Pride myself on keeping secure boxes, just wanted to make sure.