Hide personal user fields

Fixes #277
Pretty sure this is doing the opposite of what we want. Based on the [Mongoose Docs](http://mongoosejs.com/docs/2.7.x/docs/finding-documents.html) it appears that the ```fields``` parameter for the find function includes the fields you specify. By giving it the private fields, we are returning all the fields we want to keep private.