strip non-UTF8 chars from POST params

Before this change, POSTs containing params with non-UTF8 chars lead
to ArgumentError ("invalid byte sequence in UTF-8") and a 500 error.
Such POSTs can be crafted using exploit scripts.

The implementation of the sanitisation is borrowed fro the utf8-cleaner
gem (https://github.com/singlebrook/utf8-cleaner).