Adds self.protected_instance_variables to ActionController::API

This enables compatibility with the decent_exposure gem (and others). It implements the `self.protected_instance_variables` method in `ActionController::Base` (as of Rails 4.1). 

This is the cause of the issue referenced [here](https://github.com/rails-api/rails-api/issues/135)