Safer, backwards compatible sanitization for non-save methods.
On a :new action with GET parameters being sent in, we currently don’t sanitize those inputs and it causes a ForbiddenAttributes error because we are building the object with the params (even though we don’t save it). Now we make sure we sanitize parameters whenever we detect we should.

We also must do it on every ‘save action’ to be backwards compatible.