Set JsonIgnore at User (password, enabled),
locations and appointments are now accessible for ROLE_USER and ROLE_ADMIN