Modified toJSON on userSchema to remove the password from the returned object.