added notes to limit fields returned via API requsts to species and site...

I've listed the subset of fields that should be returned to the api. For other tables, the `comma do` definitions are okay, though I am not certain if we ever need to return the foreign keys, or the created_at and updated_at fields.