don't send user's password even for superAdmins b/c even though the
field is masked by browser it is exposed in HTTP response.