api tested for including user data, but excluding email and password