allow _pivot_ keys to be hidden in model.toJSON()

I found this really useful, since I end up dumping models through an API with little (if any) modification on the server side.

This way only information that's actually directly on the model or its relations gets shown.