Add a `hidden` property for hidden fields

[absolux]

hidden fields, with sensitive information, should not be returned by toJSON() like passwords, salts ... etc

var User = Model.extend({
  $hidden: [ 'password', 'salt' ]
}

All fields are visible, so to hide some, we can use the hidden flag