Changed generation behavior on Application save

The callbacks that generate client uid and  secret for the Application
model will now check if one is already provided. If so, it will not
generate a new uid or secret.

In Rails 4, mass assignment security is done in the controller. Added
extra specs to ensure MAS.