add strong_parameters

refs CNVS-16685

at this point, it is completely opt-in - you have to use
strong_params instead of params in your controller.
during mass assignment, if it's a strong params hash, it will
only use that hash; if it's not, it will use attr_accessible
/attr_protected

handling of the new exception for the API is also included

Change-Id: I0fbf3b68291ad6f02165b27e36b23cc3b666e330
Reviewed-on: https://gerrit.instructure.com/44217
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jacob Fugal <jacob@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>