Do o not return password in user object after successful authentication.