improve secret token handling (thanks brakeman devs)
prevent possible future sql injection (thanks brakeman devs)
checkin guardfile (missed in previous commits)
make custom sql sanitization more convenient
avoid possibly unvalidated redirect
avoid converting user input into symbols
don’t make association attributes mass assignable without reason
make AdminController#tree and #export available to everyone (fixes #97)