refactor json sent from creating session & checking logged in user to exclude hashed password