1. Why does `attributes` default to `nil`?  Do people expect the underlying collection to behave like a `nil`?  It seems like it should behave like a hash, so the default should be `{}` or a HIWA.

2. Why don't we add a second `permitted` parameter to the constructor that defaults to `self.class.permit_all_parameters`?  This would simplify `new_with_parameters` and you can remove the protected `permitted=` method.