code: function toJSON() {
        const model = this.toObject()
        delete model.password
        delete model.salt
  
        // Return the modified user object.
        return utils.remove_null_undefined(model)
      }
docs: When returning a user from the database,
  we don't want the password to be exposed.
  @return {Object} modified user object.