Add to serializer only for staff and current user

@pfaffman Did you find a solution for this?

Thanks!