Rails-like sensitive param scrubbing behavior

* Adds the Rails behavior of converting the list of configured filter_parameters to a regexp that matches keys. This prevents params like "password_confirmation" or "current_password" from being sent over.
* Adds a check for params that are arrays which may contain hashes
* Removes a DOS vulnerability caused by calling `to_sym` on all param keys. See http://brakemanscanner.org/docs/warning_types/denial_of_service/