Make the hits controller use strong parameters

(I plan to condense all the "make x use strong parameters" commits into
one eventually, but committing this now so I don't lose it or lose the
thread of where I am.)