hide private fields in response