Fixed syntax and specs

In Rails 4, mass assignment security is done in the controller