Remove underscore dependency in app.js

I think it's clearer to just use vanilla javascript in this case, since
we're only defaulting one value.
Implement hidden fields per document on /:collection requests

This has changed the nature of the `req.fields` value, previously it was
an object representing the fields to hide, something like `{email:
false}` to hide emails. It's now still an object, but it has a property
for each hidden document on it, and an 'all' property, which is fields
that should be hidden for all documents.