BUG FIX: don't need to pass entiable id and type as hidden field. avoids security hole.
Closed up application controller too which allowed addressable_id and addressable_type as well.