Security Fixes

Until now we've been passing the __entire__ params hash to `url_for`, which calls `symbolize_keys` on the hash passed in. The result is that an attacker can DOS your website by passing arbitrary strings as parameters. An example being:
```
victim.com/somewhere?really_long_malicious_key
```

Symbols never leave memory (until app restart), so this attack vector is quite effective against Ruby apps.

The good news is, only registered users are able to exploit this vulnerability.

I think this whole adventure was pretty cool. :sparkles: If you want to try it out yourself, [here's some tools](https://gist.github.com/Daxter/5086825).