While working with an express backend secured by passportJS, I have observed that the default behavior is to send user information in req.user (which includes the password) for each request made post logging in. Is this additional data sent through cookies? And is it safe to include the hashed password in these requests?