don't return password when user information are requested