add severals rules to user model + exclude password from json output + FIXME bcrypt password