Because of the way ExtractPaths works, `params[:format]` wouldn't
necessarily be available at the time this filter was running, and so it
would erroneously redirect to `new_user_session_path`

Takes tree-ish + path as ID

Update docs a bit

Commits#show (plural) is going to be for showing commit history on a
specific path.

set activerecord whitelist_attributes to true [2]

Project access notifications fixed

Protect users projects_limit from mass assignment.