Rails 4 support

* Removed `attr_accessible` calls
* Updated controllers to use strong parameters where possible
* Cleaned up routes

All specs pass.

Application model needs re-factoring to remove 'deprecated_finders' warnings.