do not return the hashed pwd to the client