Tidy initialize() and to_hash()

Use public_send instead of instance_variable_set so that only
attributes that we’ve predefined are allowed.