Override toJSON not to deliver password information