Update user.json

The password is now excluded from the source, it can be specifically returned if fields=password is sent in with the query.