No need for strong_params on login

when running in development, I get this warnings:
```
Unpermitted parameters: password
Unpermitted parameters: who
```

Not sure why, if the login actually works. Anyhow this is not a hash association so there is no need to use strong parameters here. Replacing this with a raw get to the params, works under rails 3.2 and 4, tested locally in both, and no warning anymore.