people.get should not return the password hash at all