Poison can't encode JSON (Phoenix)

A continuation of this situation: Can't understand destructuring in JWT auth (Phoenix)

I am setting up an API authentication using JWT with Guardian and Comeonin. This action seems to work, in that calling a user from iex and passing it into Guardian.encode_and_sign/2 gives me the tuple that I'm looking for.

  def create(conn, %{"session" => session_params}) do
    case MyApp.Session.authenticate(session_params) do
    {:ok, user} ->
      {:ok, jwt, _full_claims} = user |> Guardian.encode_and_sign(:token)
      conn
        |> put_status(:created)
        |> render("show.json", jwt: jwt, user: user)
    :error ->
      conn
      |> put_status(:unprocessable_entity)
      |> render("error.json")
    end
  end

When I make a curl request, I get this error in the console:

[error] #PID<0.565.0> running MyApp.Endpoint terminated
Server: localhost:4000 (http)
Request: POST /api/v1/sessions
** (exit) an exception was raised:
    ** (Poison.EncodeError) unable to encode value: {nil, "users"}
        (poison) lib/poison/encoder.ex:383: Poison.Encoder.Any.encode/2
        (poison) lib/poison/encoder.ex:227: anonymous fn/4 in Poison.Encoder.Map.encode/3
        (poison) lib/poison/encoder.ex:228: Poison.Encoder.Map."-encode/3-lists^foldl/2-0-"/3
        (poison) lib/poison/encoder.ex:228: Poison.Encoder.Map.encode/3
        (poison) lib/poison/encoder.ex:227: anonymous fn/4 in Poison.Encoder.Map.encode/3
        (poison) lib/poison/encoder.ex:228: Poison.Encoder.Map."-encode/3-lists^foldl/2-0-"/3
        (poison) lib/poison/encoder.ex:228: Poison.Encoder.Map.encode/3
        (poison) lib/poison/encoder.ex:227: anonymous fn/4 in Poison.Encoder.Map.encode/3
        (poison) lib/poison/encoder.ex:228: Poison.Encoder.Map."-encode/3-lists^foldl/2-0-"/3
        (poison) lib/poison/encoder.ex:228: Poison.Encoder.Map.encode/3
        (poison) lib/poison.ex:41: Poison.encode!/2
        (phoenix) lib/phoenix/controller.ex:740: Phoenix.Controller.do_render/4
        (myapp) web/controllers/api/v1/sessions_controller.ex:1: MyApp.SessionsController.action/2

What should I look for to troubleshoot this?

Take a look at this issue.

You were encoding private metadata information to the client.

But, Poison has an :except option in the @derive attribute, which can exclude a key from the encoded result:

defmodule User do
  @derive {Poison.Encoder, except: [:__meta__]}
end