create user and update user still returned passwords, fixed that