strong params
abandon devise-encryptable
local cropper components, more r4 fixes