don't return password
only decode body if we have some data