Exclude password from api