title: Conditionally prevent Django join with chained serializers
body: <p>I have a serializer, <code>requirementsSerializer</code>, that fetches two chained tables, <code>comments</code> and <code>relatedfiles</code>. In my <code>views.py</code>, I know how to conditionally filter for the related tables if the user is logged in. What I am confused about, is how to exclude/prevent the chaining/joining if a user is NOT logged in. Right now, it returns the entire set of <code>relatedfiles</code>, for all users, if the user is not logged in, which is obviously a security issue. I know I could make a second serializer that doesn't join the other tables, but that does not seem efficient or clean. </p>
  
  <p>// serializers.py</p>
  
  <pre><code>class RequirementsSerializer(serializers.ModelSerializer):
      relatedfiles_set = RelatedFileSerializer(many=True, read_only=True)
      comments_set = CommentsSerializer(many=True, read_only=True)
  
      class Meta:
          model = Controls
          fields = ('id', 'sorting_id', 'relatedfiles_set', 'comments_set', 'requirement', 'requirement_section', 'requirement_subsection', 'requirement_version')
  </code></pre>
  
  <p>// views.py</p>
  
  <pre><code>if request.user.is_authenticated():
      queryset = Controls.objects.filter(requirement_version=requirement).filter(relatedfiles__team=request.user.team_id)
  else:
      queryset = Controls.objects.filter(requirement_version=requirement) 
  </code></pre>