Base implementation

@macnibblet there is a filter for fields/properties in the hydration: the `password` should not be exposed at all, I think.