strip password/salt from returned JSON on create