Refactor omit of password

- remove password in toJSON() instead of filtering every occurrence of
user