Fix improper login param sanitization permit

This includes a failing test case that hooks into ActiveSupport
Notifications to catch the param permit error.