exclude password from search