rails/protected_attributes needs attr_protected or defaults to all protected