Remove hashed password from the response