title: ODatacontroller send every related object which have mentioned in $expand
body: <p>Using OData Controller and ODataQueryOption along with entity framework allow us to mention which Fields we need to be retrieved from database by entity framework. in the $select parameter we can specify the fields.</p>
  
  <pre><code>$select: 'Id,PersonnelNumber,FirstName,LastName,Gender,MaritalStatus,Department/Code,Department/Name',
          $expand: 'Department'
  </code></pre>
  
  <p>As you can see, it is also possible to specify the related object (in this case <strong>Department</strong>) to be retrieved, it is mentioned in $expand parameter.</p>
  
  <p>the question is, does not this option prepare security issue? since it can be provided in client side, anyone can add another parameter to that and retrieve the data which does not have permission to see. 
  for example I can add <strong>PayRoll</strong> to $expand parameter and retrieve the salary of the personnel too.</p>
  
  <pre><code>$expand: 'PayRolls'
  </code></pre>
  
  <p>how can we deal with this feature in ODataQuery option and OData Controllers?</p>
  
  <p>Thanks</p>