User.scala, password field: When returning as json, return JsonAST.JNull
so that passwords aren't revealed in js debuggers on the client