not expose user password by api
use husky
Merge pull request #7 from undoZen/master

update