This is caused by the new public_fields feature. I had thought that it defaulted to showing all properties if not enabled, but that's demonstrably not the case. I'm not sure what the best option here is. The oddness of public_fields is my fault at the time it was introduced and also mine, again, for not fixing things before 1.4.0 was released. Hopefully this isn't affecting too many people as the _users db is an internal detail in many cases and, where not, folks generally want to expose a subset of fields anyway.
For now, you can do;
curl -XPUT localhost:5984/_config/couch_httpd_auth/public_fields -d '"_id,_rev,name,password_sha,password_scheme,iterations,name,roles,derived_key,salt"' to expose all standard properties.