[TEST] User#toJSON() does not contain password