code: function filterAttributes(object, permissions) {
  		if (object) {
  			var userType = req.activeUser && req.activeUser.type || 'null';
  			for (var attribute in object._doc) {
  				if (object._doc.hasOwnProperty(attribute)) {
  					// dont return this attribute when:
  					if (!permissions[attribute] || // if this attribute is not defined in permissions
  						permissions[attribute][0] !== 'null' && // this attribute is not set as public
  						permissions[attribute].indexOf(userType) === -1 && // this attribute is not available to this userType
  						userType !== 'admin' // the user is not admin
  					) {
  						delete object._doc[attribute];
  					}
  				}
  			}
  		}
  
  		return object;
  	}
docs: Delete the attributes that the activeUser cant see
  @method filterAttributes
  @param  {object}         object      The result object
  @param  {object}         permissions The permissions object
  @return {object}                     The filtered object