Don't tell the mobile clients to show fields the user can't see

Fixes #1505
Merge pull request #1536 from maurizi/api/omit-fields-without-read-perms

Don't tell the mobile clients to show fields the user can't see