The password field should not be included in create responses to avoid sending it back out when creating or updating a record.