Hide email and remember token from public api

The email & remember token for all users were public via the API. Fixed !