don't expose password when deleting user.