remove password_hash from user json representation