title: Is it RESTful to send user role in http response?
body: <p>I'm trying to find a way to modify a web page based on the a user's authorization. For example, the owner of a resource should see <code>edit</code> and <code>delete</code> buttons while a regular user should not see those.</p>
  
  <p>The following is a method I am thinking about, but am unsure if there is a more common/better way.</p>
  
  <p>For example, assume there is a resource </p>
  
  <pre><code>project: {
      name: string,
      owner_id: id,
      moderators: [ids],
      other_stuff: string
  }
  </code></pre>
  
  <p>Would it be RESTful and good practice to extend this object with an attribute that describes what role the current logged in user is? For example, assuming this user is one of the moderators, it'd send</p>
  
  <pre><code>project: {
      name: string,
      owner_id: id,
      moderators: [ids],
      other_stuff: string,
      user_role: "moderator"
  }
  </code></pre>
  
  <p>Then the client-side framework would use <code>project.user_role</code> to display role-based controls such as <code>delete</code> and <code>edit</code>.</p>