fixing security issue, users routes should not expose (hashed) password
security issues with exposed password solved