title: Excluding private data in RESTful response
body: <p>What is the best practice for excluding certain fields/data in a RESTful response if the user requesting it shouldn't be able to see all of the data?</p>
  
  <p>Example:</p>
  
  <p><strong>Person</strong> has a <strong>First Name</strong>, <strong>Last Name</strong>, and <strong>Date of Birth</strong>.</p>
  
  <p>Both authenticated and non-authenticated users can make RESTful requests to /people.xml to get a full list of people. However, only authenticated users should be able to view all of the information. Non-authenticated users should only have the First and Last Name fields returned (excluding the Date Of Birth data).</p>
  
  <p>Should the Person controller check for authentication before building the response? If user is authenticated they get everything, else they only get a subset? Does that break any rules of REST where /people.xml can send two separate results?</p>