Removing hyperlinked models

Defaults to referencing PK of nested fields which will be much easier
to deal with programmatically
Allowing the Authorization header for XSS