pop password from API response