do not convert param into symbol

Prevent a DOS attac:
http://brakemanscanner.org/docs/warning_types/denial_of_service/

Also the gate_set is a HashWithIndifferentAccess. So no need to convert anyway.
ensure signup_email_address stays in user_params

Also factored out the user_params method.
Merge pull request #112 from azul/security/fix-brakeman-issues

Security/fix brakeman issues