fix mass assignment security issue