Removed 'password' hash from GET /user responses.