Remove private data from User responses
Reported by @yannisbarlas in https://gitlab.coko.foundation/pubsweet/pubsweet-components/issues/16#note_1264
Use a whitelist of allowed properties, or at least ensure that passwordHash
is removed from the output JSON.