{"action":"closed","issue":{"url":"https://api.github.com/repos/waterlock/waterlock-local-auth/issues/47","labels_url":"https://api.github.com/repos/waterlock/waterlock-local-auth/issues/47/labels{/name}","comments_url":"https://api.github.com/repos/waterlock/waterlock-local-auth/issues/47/comments","events_url":"https://api.github.com/repos/waterlock/waterlock-local-auth/issues/47/events","html_url":"https://github.com/waterlock/waterlock-local-auth/issues/47","id":106961390,"number":47,"title":"Password included in the response when PostAction is JWT","user":{"login":"smartcris","id":1160558,"avatar_url":"https://avatars.githubusercontent.com/u/1160558?v=3","gravatar_id":"","url":"https://api.github.com/users/smartcris","html_url":"https://github.com/smartcris","followers_url":"https://api.github.com/users/smartcris/followers","following_url":"https://api.github.com/users/smartcris/following{/other_user}","gists_url":"https://api.github.com/users/smartcris/gists{/gist_id}","starred_url":"https://api.github.com/users/smartcris/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smartcris/subscriptions","organizations_url":"https://api.github.com/users/smartcris/orgs","repos_url":"https://api.github.com/users/smartcris/repos","events_url":"https://api.github.com/users/smartcris/events{/privacy}","received_events_url":"https://api.github.com/users/smartcris/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-09-17T11:12:37Z","updated_at":"2015-09-18T10:19:50Z","closed_at":"2015-09-18T10:19:50Z","body":"I'm building a SPA, using Sails.js only as a RESTful server and I'm a bit newbie on backend. I've configured Waterlock with includeUserInJwtResponse: true and in the login section I set postActions: JWT , but after logging in I get always the password hash  in the response. I would like to avoid sending the password to the client. I tried to configure the auth model in this way:\r\n```\r\nmodule.exports = {\r\n\r\n  attributes: require('waterlock').models.auth.attributes({\r\n\r\n    toJSON: function() {\r\n      var obj = this.toObject();\r\n      delete obj.password;\r\n      return obj;\r\n    }\r\n\r\n  }),\r\n\r\n  beforeCreate: require('waterlock').models.auth.beforeCreate,\r\n  beforeUpdate: require('waterlock').models.auth.beforeUpdate\r\n};\r\n```\r\n\r\nBut it doesn't works.\r\n\r\nanother question: for a RESTful connection is it correct to configure the Sails policy in this way ?\r\n\r\n```\r\n'*': ['hasJsonWebToken'],\r\n\r\n  AuthController:{\r\n    'login':true\r\n  },\r\n\r\n```\r\n I'll really appreciate any help ;)\r\nThx"}}