Blacklist ActiveRecord attributes

* Remove need for `attr_accessible` in models.
* Allow mass assignment inside model code and specs.