Refactor #params_for_search

Refactoring `#params_for_search` and some calls to that method.

- remove #search_as_hidden_fields (unused after 39c3893)
- extract #sanitize_search_params into a stand-alone method
- change signature of #params_for_search to allow:
     - zero-arg form that just sanitized parameters
     - one-arg form that merges the request params and the arg
     - two-arg form that merges the provided source params with
           the merge params

Fixes #647 (indirectly)