Server - users.getAll should only return _id and username;