Explicitly requiring user to whitelist attributes, in prep for rails 4 and strong params.