use Rails4-style strong parameters mass assignment protection

This removes the deprecated rails3 "protected attributes" and uses rails4 style "strong parameters" instead.
All tests pass, and I've also tested everything manually to make sure I didn't break anything.