delete apiToken

src/server/models/serializers/user-serializer.js

@@ -1,6 +1,9 @@
 function omitInsecureAttributes(user) {
   // omit password
   delete user.password;
+  // omit apiToken
+  delete user.apiToken;
+
   // omit email
   if (!user.isEmailPublished) {
     delete user.email;