SQUASH ME session attr at top
Filter passwords on User model