Using the Rails4 style param security instead of protected_attributes

* Also...
  * added the User#verbose
  * an UGLY form to set and disable verbose flag.  Needs tests.