filter passwords for user list

Found out that local strategy passwords were being filtered on individual users
but not on the list of users in the API. Wrote tests and fixed the issue.