Strong parameters

Swap from using `attr_accessible` to the strong parameters pattern in preparation for the Rails 4 upgrade.

We need to do more attribute protection across the app, but that's beyond the scope of this task.

Finishes https://www.pivotaltracker.com/story/show/63293158