don't send admin_password hash to the client

the client interprets it as the __password__, and if you save unrelated settings,
it'll set the password to this hash which is obviously not what's intended