- dont return 'password', 'verification_key' or 'verification_expires' fields