Merge pull request #45 from chrismo/users_controller_change

Fixed logic to strip out user params.
Merge pull request #46 from chrismo/fix_upload

Add .gitkeep on data folder so uploads work
Capybara added to demonstrate vulnerabilities.

Adding Capybara to verify replay-ability of hacking vulnerabilities. I
imagine these may want to be kept on a different branch for QA and
educational purposes, but not distributed with master when forked.

This commit also includes demonstrating the SQL Injection vulnerability.