Remove passwordHash when serializing User to JSON
In the future the list of allowed/removed fields may need to be configurable (e.g. only admins may be allowed to see the email
field), but this fixes the immediate issue.
fixes #24
One of the tests will fail until !55 (merged) is merged.