explicitly setting attr_accessible as of rails 3.2.3