Omit password_digest in user json.
Add flash message center to header.