ActiveRecord json/xml serialization should use as base
serializable_hash, provided by ActiveModel. Add some more coverage
around options :only and :except for both json and xml serialization.
Previously we would just silently write the attribute. This can lead to
subtle bugs (for example, see the change in AutosaveAssociation where a
through association would wrongly gain an attribute.
Also, ensuring that we never gain any new attributes after
initialization will allow me to reduce our dependence on method_missing.