salt and hashedPassword should NEVER be exposed in the API