Don't return auth token

Also headers and user email address is filtered out from response.