fix(api): filter sensitive information from API response (#2103)

api/http/handler/users/user_list.go

@@ -22,8 +22,9 @@ func (handler *Handler) userList(w http.ResponseWriter, r *http.Request) *httper
 
 	filteredUsers := security.FilterUsers(users, securityContext)
 
-	for _, user := range filteredUsers {
-		hideFields(&user)
+	for idx := range filteredUsers {
+		hideFields(&filteredUsers[idx])
 	}
+
 	return response.JSON(w, filteredUsers)
 }