Update user.js

removed database credentials