Attribute method .toJSON() which restricts access to confidential field <password> was added for <User> model.