added logic to exclude the password field from JSON serialization. Part of this included tagging all fields of User aside from password with a "@Expose" annotation. Also had to add this annotation to AbstractModel's permissions map. Fixed a bug in UserDeserializer.parsePassword() where it could not handle JSON strings with field names as strings.