Don't show user's hashed password for GET show route