I've definitely felt the pain of Play JSON serialization, it's infuriating.

There's a macro that will take an entire object, generate the converter and do the conversion in one line of code, but it won't let you choose which fields not to send. So your list of users get their password hashes sent too.

For deserialization I just do it manually by pulling the fields out of the objects sent.