Removed info from list of allowed attributes in user api, as it could po...

...tentially export the oauth tokens. Refs #662