Marshaller should do mass assignment.

Setting properties one at a time bypasses the mass assignment
protection. Since Marshaller is intended to handle convert user request
data into entities, it should apply mass assignment protection rules.