I really think that we shouldn't have this stuff in the controllers *just yet*. Rather, we should wait until the work on #2540 is complete and then use that. I like the idea of excluding parameters now, but I would rather do it once and do it correctly with strong_parameters, than do it once here and then do it *again* with strong parameters later on.

There's other cases in the API where you would need to exclude parameters too.