protect mass assignment

http://rails-bestpractices.com/posts/148-protect-mass-assignment