scrubbed fields from Web API return values
added password salting, made it async on lookup