excluded password hash from user's json