Refactors so that user.password is excluded by default.

If password needed, add .select('+password') to query