Added NullUser to DRY up PostPolicy
Change settings to have an exception thrown when StrongParameters catch an unpermitted parameter.