improve json serialization in hierarchical view

* now using jbuilder in view to render json
* fixes #192 (missing authorization check)