don't send admin_password hash to the client

the client interprets it as the __password__, and if you save unrelated settings,
it'll set the password to this hash which is obviously not what's intended
Merge pull request #763 from dimagi/admin-password

don't send admin_password hash to the client