User resource explicitly excludes password, implicitly includes all other fields because user fields may change project to project