dont send down the salt or encrypted password in the json when the user logs in