sub-resources only return authorized list of objects
Merge branch 'updated'