in request discard any fields not defined in schema or user has no permission for
remove required field from basic form
on client, filter out any fields user has no permissions for