Filters out private attributes when updating a User

Fixes https://github.com/christiansmith/OAuth2Server/issues/4