remove email from user
add user dto to hide paswords from api