GET `/user/favorites` endpoint leaks user settings and some other data

[yogi]

GET /user/favorites endpoint leaks user settings and some other data

[pirijan]

thanks for the find!
Just released a fix.

favorite users now just show public attrs in this call

[yogi]

Awesome