title: How to protect the password field in Mongoose/MongoDB so it won't return in a query when I populate collections?
body: <p>Suppose I have two collections/schemas. One is the Users Schema with username and password fields, then, I have a Blogs Schema that has a reference to the Users Schema in the author field. If I use Mongoose to do something like</p>
  
  <pre><code>Blogs.findOne({...}).populate("user").exec()
  </code></pre>
  
  <p>I will have the Blog document and the user populated too, but how do I prevent Mongoose/MongoDB from returning the password field? The password field is hashed but it shouldn't be returned.</p>
  
  <p>I know I can omit the password field and return the rest of the fields in a simple query, but how do I do that with populate. Also, is there any elegant way to do this?</p>
  
  <p>Also, in some situations I do need to get the password field, like when the user wants to login or change the password.</p>