How can I enable hook.remove when I accessing a service from a custom hook?

I'm trying to create a custom populate hook for one service and each service has an user connected to it via an id.

When I do hook.app.service('users').get(id), I get the user object but the problem is that everything including the password and other sensitive data are being returned but in my user service after hooks (all) I've added hooks.remove('password',...)

Thanks in advance guys

via ginad