Add block to default_scope.

Rails 4 requires default_scope to use a block.
Remove attr_accessible from User model.

Rails 4 no longer supports the attr_accessible method of parameter
protection.  Use controller methods to implement Rails 4 "Strong
Parameters"
http://edgeapi.rubyonrails.org/classes/ActionController/StrongParameters.html