Update to Rails 4.0.0.rc1

A lot of minor changes to bring it up to :balloon: Rails 4 :tada:

- Update rails dependencies
- Update `_filter` to `_action` in controllers
- Update forgery protection which is now different between api and app
- Added strong parameterized controllers, removed `attr_accessible` from
  associated models
- Update scopes to use lambdas
- Update various configurations
- Replace `secret_token` with `secret_key_base` assuming backwards
  compatibility with prior cookies being set isn't an issue as of yet
- Set nil payload/file_sources to `{}` in specs, odd serialize behavior
  otherwise

What do you think? :8ball: