code: public List<User> find(String str, Criteria criteria) {
          Connection conn = null;
          List<User> users = null;
          try {
              conn = ConnectionUtils.getConnection();
              users = userDAO.find(conn,str,criteria);
          } catch(SQLException e) {
              logger.error(e.getMessage());
          } finally {
              DbUtils.closeQuietly(conn);
          }
          return users;
      }
docs: {@inheritDoc}
  <p>
  安全考虑，返回 List 中所有 User 的 password 属性为 null。</p>