Don't include passwords in user API