Payload refactoring

This moves all data filtering to the new `Payload` class. It also ensures that the entire payload hash is checked for infinite recursion (before it was just session, cgi_data, and params) and applies params filters local_variables.