Fix typo. Restrict query to not return hashed password and salt.