Best practices for mass assignment protection

Use rails 4 strong parameters: https://github.com/rails/strong_parameters.