url needs to be on attr_accessible