create default scope on user model that excludes sensitive information

[simonv3]

Extend sequelize's model creation to include defaultScope:

defaultScope: {
          attributes: {
            exclude: ['password'],
          },
        },
        ```