[inprogress] exlude password & email field from users queries