chore: remove passwordHash field when query user