the user_id should not be attr_accessible, security risk..