Hiding 'passhash' and 'id' from api call when finding users