Merge pull request #1080 from opf/feature/users_strong_parameters

Use ForbiddenAttributesProtection for User
Fixed bug in query model which was preventing custom fields being available.
Merge pull request #1084 from marutosi/finn-Invalid-form-authenticity-token

[security] Potentiel data leak in "Invalid form authenticity token" error screen
Small change to get custom fields of type list to be filterable.
do not display successful flash message when in wasn't
re-render everything so there won't be multiple error flash messages on the page
Add angular locales
Using query service call in filter model instead of default filters.
Overload ng locales if the language is set to German
adds specs for the bug
Merge pull request #1066 from opf/fix/peg-simplecov-version

Peg simplecov version to 0.8.0.pre
Add German angular locales for pre compilation
Merge branch 'dev-angular' of github.com:opf/openproject into dev-angular
Merge branch 'feature/simple-angular-l10n' into dev-angular

Signed-off-by: Alex Coles <alex@alexbcoles.com>

Conflicts:
	config/environments/production.rb
Merge branch 'dev' into dev-angular

Signed-off-by: Alex Coles <alex@alexbcoles.com>

Conflicts:
	Gemfile.lock
Merge branch 'dev' into fix/rspec-expect-syntax

Signed-off-by: Alex Coles <alex@alexbcoles.com>

Conflicts:
	spec/models/permitted_params_spec.rb
	spec/models/work_package/work_package_acts_as_journalized_spec.rb
	spec/models/work_package/work_package_planning_spec.rb
Convert specs to RSpec 2.14.8 syntax with Transpec

This conversion is done by Transpec 1.10.4 with the following command:
    transpec spec/models/permitted_params_spec.rb

* 10 conversions
    from: obj.should
      to: expect(obj).to

* 10 conversions
    from: == expected
      to: eq(expected)

* 1 conversion
    from: obj.should_receive(:message)
      to: expect(obj).to receive(:message)
prepend private_class_method to private class methods

this applies even if they are in the 'private part' of a class
definition as in:

class Foo
  ...
private
  def foo; 1; end
  def self.foo; 2; end
end

Foo.foo #=> 2
Foo.new.foo #=> NoMethodError: private method `foo' called
do not use ruby 2.1 features so we still support 2.0 inofficially
Merge pull request #1092 from opf/fix/ruby_2_0

Fix/ruby 2 0