Security Refactor (!!)

+ quite a bit of general refactoring
+ reverses params usage from blacklisting keys to explicitly whitelisting keys
+ adds in a monkey-patch to mitigate a similar vuln in Kaminari

We sometimes pass the __entire params hash__ to another method that calls `symbolize_keys` (often it's `url_for`).
This means that an attacker can DOS your website by passing arbitrary strings as parameters. An example being:
```
victim.com/somewhere?really_long_malicious_key
```

Symbols never leave memory (until app restart), so this attack vector is quite effective against Ruby apps.

The good news is, only registered users are able to exploit this vulnerability.

I think this whole adventure was pretty cool. :sparkles: If you want to try it out yourself, [here's some tools](https://gist.github.com/Daxter/5086825).