Issue #2956771 by jrockowitz, Berdir, aaronbauman, Sam152, Wim Leers, rickmanelius: Sensitive information is disclosed via REST/jsonapi