We remove this code here because we override the `toObject` function in the `User` model to return only the fields we deem safe. This creates one consistent point where the data is cleaned.

I'll add this to the PR description as well.