try removing "user_pass" from wp_user.to_json()