[core] Move object filtering to a mongoose toJSON transform, to easily handle subdocuments and also hide internals in the objects logged in events. Thus also change _id to id when creating users.
Merge remote-tracking branch 'origin/master' into transform-objs

Conflicts:
	modules/core/lib/db.js
[core] Move Source subdocument into a schema too
[frontend] Transform REST response object references into id/href pairs, and populate referenced objects
[frontend] Allow filtering out fields in /works response
[frontend] Let param include override fields
Merge pull request #38 from commonsmachinery/transform-objs

Transform objects in core and REST responses