removed password from '/users/create' API endpoint