Made username unique. Changed user model so that password isn't revealed when passed to client as JSON