Remove protected_attributes gem and all whitelisting
Remove mass-assignment role-based tests, no longer supported in Rails 4

Mass-assignment security roles are removed in Rails 4 so there's no need
to test :as => :role behavior.
Add support for Rails 4 strong_parameters

This brings support for Rails 4 StrongParameters changes.

- Parameter sanitizing is setup for Devise controllers via
  resource_params except Omniauth Callbacks which doesn't use
  resource_params.

- Change #build_resource to not call resource_params for get requests.
  Parameter sanitizing is only needed when params are posted to the
  server so there's no need to try to construct resource params on get
  requests (new, edit).
Fix internal helper test referencing resource_params
Remove MassAssignment security from Mongoid test shim
Change parameter sanitizer instance method to scope to devise

This way it's very explicit that this method is for devise and it won't
run into any naming collisions with user code.
Introduce BaseSanitizer null sanitizer and controller-specific callbacks

This updates Devise's StrongParameter support to feature:

- A Null base sanitizer to support existing Rails 3.x installations that
  don't want to use StrongParameters yet
- A new, simpler API for ParameterSanitizer: #permit, #permit!, and #forbid
- Overrideable callbacks on a controller-basis, e.g. #create_sessions_params
  for passing the current scope's parameters through StrongParameters and
  a helper method, whitelisted_params, for rolling your own implementations
  of #create_x_params in your own controllers.
- Lots of tests!
Clean up Devise parameter sanitizer
Update README
Merge branch 'latortuga-rails4-sp' into rails4