[1.1.0.rc2] admin/products controller sets on_hand to negative values

1. admin/products/_form partial uses 'input type=number' which renders as a text input in some browsers (e.g. FireFox 11.0 on ubuntu), thus admins can submit negative on_hand values

2. admin/products_controller#update passes negative on_hand values down to the model, resulting in products with on_hand set to negative

this PR fixes both

[Fixes #1447]