dont expose email through the API