Validate that abbr is slug-safe

We currently have one which is `directgov_www.actonco2`. This is a problem
because Rails interprets the . as indicating a format, but it is a format it
doesn't support, so Rails returns a 402.

An alternative fix would be to tweak the Site#to_param to make abbr slug-safe,
but doing it this way means that the abbr is always the slug and vice versa.

The mappings_csv_spec had to be changed to use a valid abbr.
Merge pull request #341 from alphagov/validate_site_abbr_is_slug_safe

Validate that abbr is slug-safe
Update all of the gems so that Rails 4 works

- I've probably missed some, but there'll be further updates as I go
  through every error that now exists.
- Rails 4 deprecates the :assets group within the Gemfile.
Fix some errors that came before any red tests

- Not entirely sure what these change, but I've done what the error
  output told me to do to fix the error:

  - Eager load the application only in production.
  - Remove the mass-assignment protection and the whitelist attributes
    ActiveRecord setting - this is done by strong_parameters in Rails 4.
  - Remove the unused ActiveResource config line.
Specify which HTTP methods to call on each route specified by match

- Using match on its own is deprecated.
Make RSpec render_views work again by including a new config line
Require 'rspec/expectations' and 'rspec/mocks' in spec_helper.rb
Remove deprecated specifying of which error is being raised
Remove the deprecated config.whiny_nils in dev and test
Use the new Rails 4.0 syntax for scopes
The use of stub (in some cases?) is deprecated - use double instead
Make controllers use strong parameters

- Versions, mappings, whitelisted_hosts, organisations, hits, sites,
  mappings_batch.
Add config.secret_key_base to secret_token.rb

- Rails 4 needs this, apparently. Corresponding PR opened:
  https://github.gds/gds/alphagov-deployment/pull/633, which will
  replace 'overwritten' with an actual key. Is this fine as
  'overwritten'?
Fix failing tests on orgs_sites_hosts_spec and site_yaml_file_spec

- Use `=~` instead of `eql`, because RSpec was comparing an array to a
  CollectionProxy object. Using `=~` makes it compare just the values,
  e.g. 1 == 1, therefore they're actually the same values.
- Thanks to rgarner for the `=~` tip, and https://github.com/alphagov/transition/commit/77ff1686c0271158f315bcbc851a032a141b0362.
We no longer need to patch action_controller/template_assertions.rb

- Rails 4 implements the things we needed to backport to Rails 3.
Remove attr_accessible from the user model

* Move to strong parameters
Use `breadcrumbs.tap do |links|` to silence a deprecation warning

- Found when running the Cucumber features.
Rearrange a Cucumber step definition

- This enables one failing feature to pass as the specific feature
  needed to "see" the dropdown of the tags as it typed, not click a
  button after filling in the tags filter. Thanks jennyd.
history_spec tweaks

* Re-add the specific class of expected error when user is not set
  (deprecation of supplied type only applies to `.not_to raise_error`)
* Tweak the language (drop 'should', let the context do the work of
  explaining)
Fix assumptions_spec deprecation warning

* Some deprecations are triggered just by `Module.const_get(CONSTANT)`