remove password before sending data back