Filter User fields based on perms instead of ret. unconditionally

User fields now respect normal permission checks instead of returning all fields regardless of access.