remove protected_attributes, and bring in strong_param behavior

This is the first shot at removing the `protected_attributes` gem and it's functionality, and bringing in the rails 4 `strong_params` behavior. 

Before this is merged, the controller/model created/update actions need further testing to prove `strong_params` properly protects into form inputs.