though that's a tiny bit paranoid since the serializer won't pass arbitrary data, just the fields defined on it