this commit changes GET /api/<resources> to return resource caller has access to this is not anymmore resources users is owner of