switch from attr_accessible to params.permit