django rest framework: hide some fields from the API