diff --git a/website/server/middlewares/auth.js b/website/server/middlewares/auth.js
index 69cc96afc7..d8687cae04 100644
--- a/website/server/middlewares/auth.js
+++ b/website/server/middlewares/auth.js
@@ -22,12 +22,13 @@ const USER_FIELDS_ALWAYS_LOADED = ['_id', '_v', 'notifications', 'preferences',
 function getUserFields (options, req) {
   const excluded = options.userFieldsToExclude || [];
   const included = options.userFieldsToInclude || [];
-  const urlPath = url.parse(req.url).pathname;
+  const urlPath = url.parse(req.url || '').pathname;
   if (urlPath === '/user') {
     const { userFields } = req.query;
     if (userFields || urlPath !== '/user') {
-      for (const field of userFields.split(',')) {
-        
+      const userFieldOptions = userFields.split(',')
+        .filter(field => USER_FIELDS_ALWAYS_LOADED.indexOf(field.split('.')[0]) === -1);
+      for (const field of userFieldOptions) {
         if (field[0] === '-') {
           excluded.push(field.slice(1));
         } else {
@@ -36,7 +37,6 @@ function getUserFields (options, req) {
       }
     }
   }
-  console.log(excluded, included);
   // A list of user fields that aren't needed for the route and are not loaded from the db.
   // Must be an array
   if (excluded.length > 0) {
@@ -88,8 +88,10 @@ export function authWithHeaders (options = {}) {
     if (fields && fields.indexOf('apiToken') === -1 && fields.indexOf('-') === -1) {
       fields = `${fields} apiToken`;
     }
-    console.log(fields);
-    let findPromise = (fields && fields.length > 0) ? User.findOne(userQuery).select(fields) : User.findOne(userQuery);
+    let findPromise = User.findOne(userQuery);
+    if (fields && fields.length > 0) {
+      findPromise = findPromise.select(fields);
+    }
 
     if (leanUser) {
       findPromise = findPromise.lean();