switch to strong parameters instead of protected attributes; couple of deprecation fixes