Add upsample param to safe attributes, revert thumbnail algorithm

The upsample param could - in real life situations - never be
passed to the ```PicturesController```; it would always be filtered
out in the clean_picture_params method. Fixed by including it in
the list of safe params.

The cropped_thumbnail algorithm did not work as expected; it's now
reverted to the original algorithm (with a slight modification
allowing for one dimension to be set to zero).