populate req.user with positions name and remove pw and salt