do not reveal password hash via api