Changed user creation to hash password.  Removed password as write only on the serializer, maybe a hack since gets will now show the hash pass.  But not a big deal since it's a one way hash anyway