removed password and salt from fetching user