Protect Submission.votes attribute

We don't really want users to be able to set the votes attribute
so we are removing it from the form and prevent the use of the
parameter in the controller