Remove leading slash.

It is not needed.
Update mass assignment to be guarded by default.

Having to enable guarding makes apps less secure by default, and forces
users to opt into what should be a safe/secure default.

Setting properties individually should not be subject to mass-assignment
rules as it is probably not mass assignment.
Disable guarding on internal methods.

Disable guarding on the ORM internals. The internals should never be
guarded as they are generally wiring entities together or doing internal
data manipulation.
Fix failing tests in Entity test.
Add tests for single set + accessible properties.
Marshaller should do mass assignment.

Setting properties one at a time bypasses the mass assignment
protection. Since Marshaller is intended to handle convert user request
data into entities, it should apply mass assignment protection rules.
Merge pull request #2524 from markstory/3.0-safer-mass-assignment

3.0 safer mass assignment