remove password when getting user by id