hide password; ensure distinct users in csv export