Added cookies to recover auth for headers.
Removed filtered User.update function to remove '_id' fields.