hide password from API call, add email field on user model, add email field on dummy user test