added checks that password is not returned to client