remove hashed_password & salt from /user