do not include password hash in search results
also do not include rand_id