remove created_by from user serializer