not returning passwordhash and salt on GET calls