return unauthorized if no token supplied
delete password when returning json