Updated user projection to never send password