diff --git a/src/controllers/user.js b/src/controllers/user.js
index 0905ecb97f..e03a9caa28 100644
--- a/src/controllers/user.js
+++ b/src/controllers/user.js
@@ -396,8 +396,7 @@ api.buy = function(req, res, next) {
 
 
 api.getUser = function(req, res, next) {
-  var user;
-  user = res.locals.user;
+  var user = res.locals.user.toJSON();
   user.stats.toNextLevel = algos.tnl(user.stats.lvl);
   user.stats.maxHealth = 50;
   delete user.apiToken;