Hide sensitive fields from the API

Exclude the `salt` and the `hashed_password` from the API