Sanitize user object in user create response

The user object in the response from creating a user contained the `hashed_password`, but it shouldn't. This PR ensures that the user object is sanitized before sending back to the client.