Don't send created_by and updated_by attrs in API requests

refs https://github.com/TryGhost/Ghost/issues/9548
- refactor serialisers to use `serialize` rather than `serializeToHash` to avoid code duplication
- strip `created_by` and `updated_by` attrs when serializing - Ghost will set these automatically based on the currently logged in user

ghost/admin/app/serializers/application.js

@@ -3,6 +3,16 @@ import {decamelize} from '@ember/string';
 import {pluralize} from 'ember-inflector';
 
 export default RESTSerializer.extend({
+    serialize(/*snapshot, options*/) {
+        let json = this._super(...arguments);
+
+        // don't send attributes that are updated automatically on the server
+        delete json.created_by;
+        delete json.updated_by;
+
+        return json;
+    },
+
     serializeIntoHash(hash, type, record, options) {
         // Our API expects an id on the posted object
         options = options || {};

ghost/admin/app/serializers/post.js

@@ -29,32 +29,19 @@ export default ApplicationSerializer.extend(EmbeddedRecordsMixin, {
         return this._super(...arguments);
     },
 
-    serializeIntoHash(hash, type, record, options) {
+    serialize(/*snapshot, options*/) {
-        options = options || {};
+        let json = this._super(...arguments);
-        options.includeId = true;
-
-        // We have a plural root in the API
-        let root = pluralize(type.modelName);
-
-        // TODO: this is throwing a warning when saving a new post:
-        // The embedded relationship 'tags' is undefined for 'post' with id 'null'.
-        // Please include it in your original payload.
-        //
-        // This appears to be an issue in Ember Data - needs further investigation
-        // and possibly an issue raised
-        let data = this.serialize(record, options);
 
         // Properties that exist on the model but we don't want sent in the payload
-
+        delete json.uuid;
-        delete data.uuid;
+        delete json.html;
-        delete data.html;
         // Inserted locally as a convenience.
-        delete data.author_id;
+        delete json.author_id;
         // Read-only virtual property.
-        delete data.url;
+        delete json.url;
         // Deprecated property (replaced with data.authors)
-        delete data.author;
+        delete json.author;
 
-        hash[root] = [data];
+        return json;
     }
 });

ghost/admin/app/serializers/tag.js

@@ -8,18 +8,13 @@ export default ApplicationSerializer.extend({
         updatedAtUTC: {key: 'updated_at'}
     },
 
-    serializeIntoHash(hash, type, record, options) {
+    serialize(/*snapshot, options*/) {
-        options = options || {};
+        let json = this._super(...arguments);
-        options.includeId = true;
-
-        let root = pluralize(type.modelName);
-        let data = this.serialize(record, options);
 
         // Properties that exist on the model but we don't want sent in the payload
+        delete json.count;
 
-        delete data.count;
+        return json;
-
-        hash[root] = [data];
     },
 
     // if we use `queryRecord` ensure we grab the first record to avoid