title: Ember: Secureness in model-responses with private data
body: <p>If writing an ember application using ember-data with an Backend for persistence, how can I handle sensitive data?</p>
  
  <p>Lets thing about the following szenario:</p>
  
  <p><strong>"As a user I want to log into my app"</strong>
  => <em>the client (ember-data) will hold an <strong>instance of User</strong> with all neccessary informations. Their are also some fields included which are very <strong>private</strong> like the Facebook-UID for example or something else.</em></p>
  
  <p><strong>"A a user I want to manage a list of my friends"</strong> => <em>Okay, it seems like on some routes, the client have to fetch other user-records from the database to resolve for example the names of the people who are related as id's in the 'myFriends'-field of the current user object</em></p>
  
  <p><strong>The model for User</strong></p>
  
  <pre><code>name: DS.attr('String'),
  myFriends: DS.hasMany('User') 
  </code></pre>
  
  <p>So basically the problem is that some Data-Records has references to other Data-Records from the same model but some of the fields in the records are not public and therefore shouldn't be requestable. But Ember-Data will allways request the whole model and even when im writing my backend in the way of sending back ony reduced data-records I guess that ember-data wont like that when some of the fields are marked as "undefinied", right? </p>