Put responsibility for protecting attributes into the UserController
Merge pull request #808 from projecthydra/remove_permitted_attributes

Put responsibility for protecting attributes into the UserController