add tests to make sure salt and password_hash are not returned in JSON to client