start using strong_params rather than attr_accessible