including ActionController::Serialization in ApplicationController

app/controllers/application_controller.rb

 class ApplicationController < ActionController::API
+  include ActionController::Serialization
   include DeviseTokenAuth::Concerns::SetUserByToken
   include Pundit
 
-  respond_to :json
-
   # Prevent CSRF attacks by raising an exception.
   # For APIs, you may want to use :null_session instead.
   # protect_from_forgery with: :null_session

app/serializers/user_serializer.rb

 class UserSerializer < ActiveModel::Serializer
-  attributes :id, :email, :created_at, :updated_at, :auth_token
+  attributes :id, :email, :created_at, :updated_at
+  has_many :roles
+  has_many :institutions
 end
\ No newline at end of file