User#as_json, merge with existing excepts