An include parameter can return objects the caller was never allowed to read

Plenty of REST APIs let clients expand related objects in one call, like GET /invoices/42?include=customer,notes. The handler checks that the caller can read invoice 42, then loads whatever the includ