added a user object, set up JSON serialization without password.