Migrate mass-assignment security to strong_parameters

Ahead of the upgrade to Rails 4, this change removes the use of attr_accessible and attr_protected as mass assignment protection mechanisms in favour of whitelisting input attributes at the controller level.

See http://blog.markusproject.org/?p=5588 for more details.

All tests are passing, and some playing around with a local server seemed to work correctly. At this point I have some confidence that this is done correctly.
Prefer single-quoted strings when you don't need string interpolation or special symbols.