I played with this a little and realized it was better to limit before handing data to the serializer, to prevent DRF from serializing data that won't be returned. Added a test to prove this and prevent accidents in the future.