hide password when getting user