Bug 997848 - Inherited capabilities not in REST API

With the changes to use CapabilityProxy, the default API serialization (Rails)
was serializing the user's underlying attribute from Mongoid, not the proxy
overlay of inherited capabilities.  Changed to use serializable_hash which
uses the proper values

[merge]