use symbols for source fields that should be hidden
admin users should see passwords in display mode
ALM-612 we no longer check the content type in API responses, but rather try to parse as JSON or XML