remove password from responses