Removing sessionToken and authData from _User objects included in a query (#1450)

* Removing sessionToken and authData from _User objects included in a query

This bug caused sessionToken to be replaced on client side to some old
sessionToken from DB.

* Removing dangling variable that is never used

src/RestQuery.js

@@ -450,7 +450,6 @@ function includePath(config, auth, response, path) {
     return response;
   }
   let pointersHash = {};
-  var className = null;
   var objectIds = {};
   for (var pointer of pointers) {
     let className = pointer.className;
@@ -477,8 +476,9 @@ function includePath(config, auth, response, path) {
         obj.__type = 'Object';
         obj.className = includeResponse.className;
 
-        if(className == "_User"){
+        if (obj.className == "_User") {
           delete obj.sessionToken;
+          delete obj.authData;
         }
         replace[obj.objectId] = obj;
       }