I would prefer to (hackily) make something that looks exactly like a subset of what the default REST representation of User, so that we can eventually slot in a webservices.rest-based implementation without breaking existing usage.