Make sure that neigbors_attributes is allowable

Since the neighbors_attributes is getting sent with the rest of the parameters, it has to be whitelisted as an allowable attribute.

We probably could have figured this out at the hack night, but we must not have tried this permutation.