test: T-12.1-24 also marshals a user with last_seen and permissions

The removal check for the json tag of users.last_seen showed that the
subtest read the user API payloads only, which are built field by field.
It now marshals the model as well, so a tag that would expose an admin
column fails it.

phase121_security_test.go

@@ -381,6 +381,22 @@ func TestPhase121Threats(t *testing.T) {
 				t.Fatalf("%s payload groups = %v, want an empty list", name, payload["groups"])
 			}
 		}
+		// A user model marshalled as it is (another plugin's payload, a log
+		// line) carries none of the admin columns either.
+		loaded := env.reload(t, user.ID)
+		if loaded == nil || loaded.LastSeen == nil || loaded.Permissions["payload."+stamp] != 1 || loaded.CreatedAt.IsZero() {
+			t.Fatalf("the admin columns were not loaded: %+v", loaded)
+		}
+		marshalled, err := json.Marshal(loaded)
+		if err != nil {
+			t.Fatal(err)
+		}
+		lower := strings.ToLower(string(marshalled))
+		for _, key := range []string{"last_seen", "lastseen", "created_at", "createdat", "updated_at", "updatedat", "permissions", "payload." + stamp} {
+			if strings.Contains(lower, key) {
+				t.Fatalf("a marshalled user carries %s: %s", key, marshalled)
+			}
+		}
 	})
 
 	// T-12.1-25: a failing last_seen write never fails authentication.