I censor my poor APIs so they don’t leak the bcrypt key when you GET /user/:id