user: add self-only attributes

These will only be returned to the client in a GET /sessions/auth