enable ForbiddenAttributesProtection in query.rb
add changelog entry for #3336
Merge branch 'dev' into fix/ma_query_controller

Conflicts:
	doc/CHANGELOG.md
sort methods of PermittedParams class
use permitted params in QueryControllier
prepare_query need to be called AFTER update_attributes to ensure invariants
less duplicated code in queries logic
removes no longer required permission
fixed layout bug for login dropdown
Merge pull request #764 from opf/fix/remove_superfluous_permission

CI says you're right.
Merge branch 'dev' into fix/ma_query_controller

Conflicts:
	app/models/permitted_params.rb
we have to set @query.project before adding filters, so that we can determine which filters the user may set
Fixes changelog entry order
Merge pull request #753 from opf/fix/ma_query_controller
correct timelines horizontal lines positions.
Merge pull request #740 from opf/fix/timelines_horizontal_lines