remove password_digest from user params