remove attr_protected for :locked and :sticky.

They are safed by safe_attributes depending on the user permissions.

Later strong_parameters will be used for that. But I don't have enough time for that at the moment.