Generally, it's best to avoid ever calling `to_sym` on anything that could come from a user because symbols in Ruby [don't get garbage collected](http://www.tricksonrails.com/2010/06/avoid-memory-leaks-in-ruby-rails-code-and-protect-against-denial-of-service/), so they can fill up RAM.  I think we've removed all places where we `to_sym` user code, but we should fix it in specs too for consistency.  [Brakeman](http://brakemanscanner.org/) is a good tool for finding issues like this.