api/v1/user.json returns a user without api_key

If a user that has no api key exists, api/v1/user.json returns the user.
Created users usually have auto-generated api keys,
but old users do not have api keys.
So this problem may show secret users.