Mark password hash as protected so it doesn't get passed around when serializing to JSON.