extract JsonPublicFieldsOnly to encapsulate common @JsonAutoDetect visibility usage, add test for User marshalling