Forbidden attributes protection

Add Forbidden attributes protection support, and move old school `attr_accessible` and `attr_protected` to optional plugin modules.