return user instead of array with user inside
don't send password hash to client