Restrict info returned from API calls

only return information that's absolutely necessary (e.g. user emails and gps coords should never be given to the frontend)