fixed a security issue where the server would

fixed a security issue where the server would return the entire user
object to the client (with the hashed password and the salt)