Makes sure we don't strip authData or session token from users using masterKey (#2348)

* Makes sure we don't strip auth data or session token from users queried with masterKey (#2342))

* nit: test title

src/RestQuery.js

@@ -504,7 +504,7 @@ function includePath(config, auth, response, path) {
         obj.__type = 'Object';
         obj.className = includeResponse.className;
 
-        if (obj.className == "_User") {
+        if (obj.className == "_User" && !auth.isMaster) {
           delete obj.sessionToken;
           delete obj.authData;
         }