sailsjs: Avoid saving some form inputs in database

I am trying to make a signup page, following irl nathans guide. Now everything works, however sail.js seems to save everything from the form in the database. For an example, I have this form:

<form class="form-signup" name="signup-form" action="/user/create" method="POST">
    <input type="text" name="username" placeholder="<%= __('username') %>"> %>">
    <input type="text" name="email" placeholder="<%= __('email') %>">
    <input type="password" name="password" placeholder="<%= __('password') %>">
    <input type="password" name="confirmation" placeholder="<%= __('confirm-password') %>">
    <input class="button" type="submit" value="<%= __('signup') %>"/>
    <input type="hidden" name="_csrf" value="<%= _csrf %>"/>
  </form>

In this example it saves both the password and the password-confirmation in the database, which it shouldn't.

In my User.js model I have the following attributes, but these are just saved alongside the two passwords. I also have an encryptedPassword, that encrypts the password if they match.

module.exports = {
  attributes: {
username: {
  type: 'string',
  required: true,
  unique: true
},
email: {
  type: 'string',
  required: true,
  isEmail: true,
  unique: true
},
encryptedPassword: {
  type: 'string'
},
// more unimportant code here.
}

I would like to know whether and it is possible to prevent sails.js from saving the two unencrypted passwords in the database whenever the form is submitted. I know I can just remove it afterwards from the database, however, that seems kind of stupid.

The saved record in the database, when submitted:

 {
    "username": "testuser",
    "password": "2",
    "confirmation": "2",
    "email": "myemail@email.com",
    "createdAt": 1496268539155,
    "updatedAt": 1496268539155,
    "encryptedPassword": "$2a$10$BkwvQnu3TA4DQ1kDMZmi6O7Z/K5uX90fHi/6zkZF.nkKi8MU.zWTS",
    "id": "592f3efbaa4d2563e159dc20"
  }

Since I am encrypting the password, it shouldn't also save the unencrypted passwords, just because they were part of the submit form. How do I prevent it from doing so?

via sleort