User information exposure

[grololo06]

In all API calls, user information should removed from response for user without (minimum) view rights on the project.
Manager names should not be exposed at all.
Contact name can be exposed to public.

Crypted names should be consistent inside API output for a given call, but not across time.

[jiho]

The decision is to:

• show name + email of contact person everywhere
• show name + email of persons with other statuses (viewer, annotator, manager) when the privilege of the user doing the request is viewer or up
• show anonymised names and no email when the user doing the request is not logged in or has no privilege; those anonymised names are dynamic, per request and look like "anonymised user 1", "anonymised user 2"