Clean up user object to remove IP address - client application can use
anything as the "username" - it's a generic identifier.