Just do:

user.password = undefined;

instead of:


delete user.password;