Security fix - do not return password when user logs in