don't assume all parameters are strong parameters

also added tests for strong parameters on where queries