Employees are accessible through references via REST

[alexgutjahr]

When an employee with the role ROLE_EMPLOYEE calls a rest endpoint returning an employee via a reference, i.e. the approver for a travel expense report s/he can access all properties.

Example:
curl -H "Authorization: Bearer $TOKEN" localhost:8080/travelExpenseReports/0/approver

The same employee might not be accessible via employees/$ID.