Move param filtering to Payload.
Filter local_variables.
Expect whitelisted objects in Rails 2 spec.