Handle hidden fields on individual documents

This handles hiding fields on individual documents as opposed to doing
it collection-wide. Currently it only works for `/:collection/:id`
routes, I foresee a potential issue with the `/:collection` urls because
there will be multiple individual documents in the response, so we may
have to restructure `req.fields` to make the representation clearer, but
that can be tackled next.