fix mass assign security restriction rails 3.2