fix possibility for param injection

because we’re passing params[:variant] through a `send` method, like
`send(“#{variant}_close_time`, we are vulnerable to users executing bad
methods.

this change sanitizes those params before sending them to the model