[useradm] empty password in responses to GET /users, GET /users/:id

the password is concealed, so that's good, but an empty "password": "" is still in the struct.

add omitempty where necessary to avoid this