Mask unauthorized fields in api including UDFs

fixes #987 on github