Fixing what I consider to be a security issue. When returning a JSON response, we do not need an ID sometimes. For example, we do not need this when a user wants to reset their password: all this does is expose an internal user ID to a potential attacker