API: optionally restrict moderators from accessing sensitive data