used mongoose-hidden to hide password field in model