small fixes on services to allow user update without returning salt passwords