Proteceted fields not hidden in REST json

Need Help
1

Cakephp 3.6.7
CakeDC users plugin 7.0.2

/**   vendor\cakedc\users\src\Model\Entity\User.php
 * Fields that are excluded from JSON an array versions of the entity.
 *
 * @var array
 */
protected $_hidden = [
    'password',
    'token',
    'token_expires',
    'api_token',
];

but those fields not hidden on API call