update GET /auth/user/:userid return data

we don't return the private data from the api