Plug security hole where JSON version of gallery/index was sending everything, including passwords (which really ought to be hashed but meh).