Make controllers use strong parameters

- Versions, mappings, whitelisted_hosts, organisations, hits, sites,
  mappings_batch.
Add config.secret_key_base to secret_token.rb

- Rails 4 needs this, apparently. Corresponding PR opened:
  https://github.gds/gds/alphagov-deployment/pull/633, which will
  replace 'overwritten' with an actual key. Is this fine as
  'overwritten'?
Fix failing tests on orgs_sites_hosts_spec and site_yaml_file_spec

- Use `=~` instead of `eql`, because RSpec was comparing an array to a
  CollectionProxy object. Using `=~` makes it compare just the values,
  e.g. 1 == 1, therefore they're actually the same values.
- Thanks to rgarner for the `=~` tip, and https://github.com/alphagov/transition/commit/77ff1686c0271158f315bcbc851a032a141b0362.
We no longer need to patch action_controller/template_assertions.rb

- Rails 4 implements the things we needed to backport to Rails 3.
Remove attr_accessible from the user model

- This uses Whitehall's implementation of overriding attr_accessible,
  because Rails 4 errors when it encounters attr_accessible, but the
  gds-sso gem is still using attr_accessible. Found through jennyd and
  https://github.com/alphagov/whitehall/blob/11b5293230c318ebca3444b5bc700841ca4810f6/lib/attr_accessible_noop.rb.
Use `breadcrumbs.tap do |links|` to silence a deprecation warning

- Found when running the Cucumber features.
Rearrange a Cucumber step definition

- This enables one failing feature to pass as the specific feature
  needed to "see" the dropdown of the tags as it typed, not click a
  button after filling in the tags filter. Thanks jennyd.