rails4: use ActiveModel::ForbiddenAttributesProtection

GitHub: #61

Because ActiveModel::MassAssignmentSecurity is removed removed from
ActiveModel 4.