Migrate mass-assignment security to strong_parameters

Ahead of the upgrade to Rails 4, this change removes the use of
attr_accessible and attr_protected as mass assignment protection
mechanisms in favour of whitelisting input attributes at the
controller level.

See http://blog.markusproject.org/?p=5588 for more details.

All tests are passing, and limited playing around with a local server seemed to work correctly. However, I am not confident that I have get the assignments controller completely working and there may be cases that the tests do not cover. So, I am opening this PR for review only at this time.
Use `&&` instead of `and`.