Permissions: let's not serialize the full content objects for ContentList views