Use strong parameters in controllers

Instead of blindly accepting everything, use Rails 4 strong parameter
feature and restrict what can and cannot pass.