add password to user serializer