Adds support for restricting mass assignment of attributes

The idea here is to integrate with strong_parameters in the policy, but without explicitly coupling with it.