Fixed: remove password from user object with the delete keyword - otherwise upserts may fail