filtering api views and applying permissions based on user