feat: consider "public" and "private" user fields

[Regaez]

Perhaps the UserResource object should not expose fields such as access or state... unless the request is authenticated for that user, or an admin?

We currently always filter out hashed_password so that it is not exposed publicly.