do not include password in json for users#index and users#show