title: Sequelize findOrCreate not excluding attributes defined in the exclude array
body: <p>Following is the code:</p>
  
  <pre><code>Accounts.findOrCreate({
      where: {
          userName: request.payload.userName
      },
      attributes: { exclude: ['password','sessionToken'] },
      defaults: request.payload
  }).spread(function (account, created) {
  
      if (created) {
          var account = account.get({
              plain: true
          });
  
          console.log(account);   // has the password and sessionToken fields
  
          return reply(account).code(201);
      } else {
          return reply("user name already exists").code(422);
      }
  
  });
  </code></pre>
  
  <p>I noticed that sequelize first fires a select query in which the password field is not present, then it fires an insert statement in which the password field is present, and that needs to be there.</p>
  
  <p>I would just like the password and sessionToken not be present in the resulting account object. I could of course delete those properties from the object but I am looking for a more straightforward way.</p>