hide email and password from all get requests