being explicit about turning off whitelist only for Rails 3