hide password hash on GET /user