TBH I don’t think Discourse submitting a password over HTTPS is your largest security challenge at this moment.
Sure. I think you get most stuff in the standard user serializer.
But if that’s not enough you can always use the API to grab more information from Discourse.