fix small logic mistake
hide som sensitive data like pasword, confirmcode before return to browser