data/models/user: export Password field, strip all passwords in api/v0/users