application_controller
- with cancancan we no longer need the hack to call the
  controller parameter method explicitly, since cancancan
  wraps this intelligently
repository_users_controller
- fixed to use strong params properly now that cancancan works
  as advertised
projects_controller_test
- some things that were being denied by strong params are
  now denied by cancancan, with different redirect or
  response type consequences than before.  No protections
  have been lost.

ALL TESTS PASS