Minor tweaks

Some minor changes:

* Don't require 'rspec/autorun' as it's not generally required and conflicts with some test runners
* Pass through options to super call on `as_json` override
* Whitelist public attributes instead of blacklisting internal ones