Update fields returned by GET /api/v2/me

Prior to this change, the `GET /me` endpoint exposed potentially sensitive user attributes (e.g. `api_token`) as well as  internal-only fields (e.g. `other_organisation`, `department_id`, `dmponline3`, etc.).

Now the endpoint only returns useful information (note the language.name rather than language_id and org.name rather than org_id improvements as well).

Author: aaronskiba

app/controllers/api/v2/base_api_controller.rb

@@ -28,7 +28,10 @@ def heartbeat
 
       # GET /me.json - recommended for doorkeeper gem
       def me
-        respond_with @resource_owner
+        render json: @resource_owner.slice(:firstname, :surname, :email).merge(
+          organisation: @resource_owner.org.name,
+          language: @resource_owner.language&.name
+        )
       end
 
       private