Change to json response + hash passwords