Deserializing functions and authentication strategy keep hash and salt fields on user object

[mattiasahlsen]

In my application the user object I get on req.user contains the password hash and salt, which should obviously not be sent to the client so I had to remove them myself. Is this a bug? If so, I can try to fix it.