delete password hash on response
delete password hash on response