Should `ctx.state.user` contains `password`?
When I use `koa-passwort` with `passport-local`,
user database info such as `password` are in `ctx.state.user`.

What's `ctx.state.user` used for ?
Should I wrap(remove `password`) it before pass to frontend, or I made some mistake ?