fixed security whole: list-users no longer lists passwords