Totally removed protected attributes from the app.

WIP: put strong parameters in all controllers.