60189676 mass assignment issues

Removes all mass assignment vulnerabilities found in CodeClimate. Also, adds a couple queries to make two controllers much simpler which were getting dings on CodeClimate as C's for duplication.

Note this is a sizable PR for a day before release, and although specs are passing, I'm anxious about releasing without further testing.