Only return a users private field when that user requests

Passes the requesting user to the user serializer. Only returns
private fields when the requester is the same as the returned model
or an administrator