[#78845544] filter roles on serializer, not controller

- includes spec to detail behavior