whitelist fields in AppSerializer