Use paranoia for deleted_at functionality

Fixes #3321
No need to call accessible_by again in ProductsController, as it is already done in BaseController's product_scope