Fix exploit making user name change reasons being public in API.

app/models/user_name_change_request.rb

@@ -89,4 +89,12 @@ class UserNameChangeRequest < ActiveRecord::Base
       return true
     end
   end
+
+  def hidden_attributes
+    if CurrentUser.is_admin? || user == CurrentUser.user
+      []
+    else
+      super + [:change_reason, :rejection_reason]
+    end
+  end
 end