hiddenFields exposed in relationships

[basz]

Given two DTO's (Identity and Preference) where Identity has a hidden field passwordHash.

I noticed that when I serialize the Identity DTO the passwordHash field is correctly hidden.

But when I serialize Preference with a relationship to to Identity the passwordHash is not hidden.

{
  "data": {
    "type": "identity/preference",
    "id": "212dca7d-87be-500f-a269-0ddef0757415",
    "attributes": {
      "name": "restriction.ip.enabled",
      "preference_id": "212dca7d-87be-500f-a269-0ddef0757415",
      "value": false
    },
    "relationships": {
      "identity": {
        "data": {
          "type": "identity/user",
          "id": "fff1324d-1383-5363-a6db-b9b7d2f856e9"
        }
      }
    }
  },
  "included": [
    {
      "type": "identity/user",
      "id": "fff1324d-1383-5363-a6db-b9b7d2f856e9",
      "attributes": {
        "passwordHash": "$2y$14$Q0xLWS....",
        "displayName": "Xxxxx Xx Xxx",
        "emailAddress": "[email protected]",
        "registrationDate": "2012-12-20T13:41:29+0100",
        "emailStatus": "verified",
        "accountStatus": "active",
        "roles": [
          "guest",
          "member",
          "admin",
          "member.customer"
        ]
      }
    }
  ],
  "jsonapi": {
    "version": "1.0"
  }
}