Fix #45, don't include password digest in user json calls