`update_attributes` bypasses a bunch of ActiveRecord stuff, like validation.