Add to serializer only for staff and current user

I don’t remember, but I think the above should work.