no longer return password hash and other junk data when logging in