Fix #191 Fixed $field:1 for UserCollection

When there is a $field:1, make sure that password is not included.
Also added unit tests