Protected Attributes -> Strong Parameters

This pull request removes the protected attributes gem from the Gemfile and implements strong parameters for every resource in the project. (in addition to refactoring of many controllers and re-aliasing before filters to before action and other minor style changes)
The ability is never defined, but since admins and superusers are granted :manage, :all capabilities it will return true for them and false for other user groups. I can add a comment in to clarify it. 

As for your second point, I'm not sure; for the most part I just copied the old attr_accessible attributes from the model. I can begin testing for unnecessary attributes but it's hard to test.