chore: remove passwordHash field in auth's res