protect attributes in controller, but recursive modification doesn't work yet