title: Rest API Return Either Properties based on role or different entity
body: <p>I'm curious when building a proper restful resource, what is the best action to take returning a resource based on a user's role.  </p>
  
  <p>For example,
  If User 1 calls, GET: api/Users/1
  That user should get the base user object (first name, last name, email) along with proprietary information like SSN.
  But if User 2 calls, GET: api/Users/1
  That user should get the base user object along with maybe their mutual friends they share.  </p>
  
  <p>Is this something that is advocated in a restful resource, or would be easier to separate these concerns into something more specific, like api/Users/1/sensitive, and api/Users/1/Friends?</p>
  
  <p>If the former is acceptable, would this be something manageable through inheritance?</p>
  
  <p>Thanks!</p>