`to_h` is explicit coercion that's implemented by many other classes that aren't params-like, so that won't work.

Considering we're offering up `Parameters` with a different kind of API for working with request params, we should warn ppl to start using that API instead, then rely on explicit coercion when they pass `params` to other libraries that expect to work with hashes.

Of course, this is a huge pain for everyone to deal with. "Uhh so I have to use `params.to_h` everywhere now??" We could inadvertently introduce a worse security situation, where users spam `.to_h` to "fix" problems.