Ran into a similar problem after installing it today, here is my function that I wrote (stick it in your themes functions.php). Hopefully the comments make sense!
// restrict post/page access to specific fields
add_action('json_api-core-get_post', 'rmv_restrictAPIFields');
add_action('json_api-core-get_posts', 'rmv_restrictAPIFields');
add_action('json_api-core-get_recent_posts', 'rmv_restrictAPIFields');
add_action('json_api-core-get_page', 'rmv_restrictAPIFields');
add_action('json_api-core-get_date_posts', 'rmv_restrictAPIFields');
add_action('json_api-core-get_category_posts', 'rmv_restrictAPIFields');
add_action('json_api-core-get_tag_posts', 'rmv_restrictAPIFields');
// general function which makes sure that any allowed fields get included in a request
function rmv_restrictAPIFields($query) {
global $json_api;
$json_api->response->exclude_values = ""; // make sure that exclude values can't be used
$allowedFields = array('title','title_plain','slug','url','content','excerpt','categories','tags','thumbnail','thumbnail_size','custom_fields');
$defaultFields = array('title_plain'); // used if no include options are requested
$requestedFields = $json_api->response->include_values;
$theFields = array_intersect($allowedFields, $requestedFields);
if(sizeof($theFields) == 0) { // no "include" values have been set, or there are no allowed fields defined - use the defaults
$json_api->response->include_values = $defaultFields;
} else { // give them what they asked for!
$json_api->response->include_values = $theFields;
}
}