Mix ForbiddenAttributesProtection into all models

Rails 4 will have this behaviour in all models so I'm mixing it in now
to get any issues fixed before we upgrade.