Exclude password and refresh_token fields from result of user creation api call

[OksentukVlad]

We can either exclude them manually in place or add toJSON method to User instance like suggested here: https://stackoverflow.com/questions/45655612/sequelize-dont-return-password-on-create