the hiddenAttributes exclusions should not be inside toJSON because that is what gets saved to the DB. it should be inside render