all models can now be mass-assigned because before_action already take care of this issue
n+1 queries fixes