hey does anyone know a clean way to exclude properties from a mongoose document toJSON (for example to avoid sending passwordHash to the client)?