json return will not return sensitive data