Fix dynamic shared methods can't hide

I'm trying to fix https://github.com/strongloop/strong-remoting/issues/94

Put the following code in a boot script. It should hide all the routes except *POST /api/Users/login*.
```js
User.sharedClass.methods().each(method) {
  method.shared = false;
});
User.sharedClass.find('login', true).shared = true;
```

Signed-off-by: Clark Wang <clark.wangs@gmail.com>