Use strong_parameters for User, remove safe_attribtues
Fix Users controller test with strong parameters
Remove attr_protected on User now that we use strong_parameters
Allow plugins to add permitted attributes
Add spec for PermittedParams.add_permitted_attributes