Refactor omit of password

- remove password in toJSON() instead of filtering every occurrence of
user
- changed faulty error type ‚NotFound‘ to ‚NoPermission‘
Merge pull request #2691 from sebgie/omit-password

Refactor omit of password