adds _logout back to User.replaceWith, moves _updateDb out of _logout
and fixes getPersistentJson - mongo inserts nulls for undefined as
opposed to omitting the property altogether, so the trick of just
putting the password argument in there anyway doesn't work.