removed attr_accessible in user.rb