making always permitted params configurable

Getting errors related to 'format' not being allowed as a param. Having to permit 'format' everywhere is messy, but I wasn't sure about changing S.P. to always allow format for everyone, since it is a client-supplied param and there may be some valid reason to allow control over permittance of 'format' rather than always permitting it. So, it seemed that just allowing `NEVER_UNPERMITTED_PARAMS` to be modifyable would be the best idea, so I converted it into a configuration option, using fewer double negatives ("always_permitted_parameters"). Not sure if that works for everyone or not, so this is really just a conversation starter.