don't keep user password in returned user profile

stops the password from being transmitted to the client in the user
profile sent there

src/mtgcoll/auth.clj

@@ -9,7 +9,8 @@
 (defn validate-credentials
   [username password]
   (if (using-authorization?)
-    (->> (config/get :users)
-         (filter #(and (= username (:username %))
-                       (= password (:password %))))
-         (first))))
+    (as-> (config/get :users) x
+          (filter #(and (= username (:username %))
+                        (= password (:password %))) x)
+          (first x)
+          (dissoc x :password))))