fix(api) remove user password before sending