HATEOAS in RESTful API partially implemented (lacking query support and remove restricted attributes)