include ForbiddenAttributeProtection in correct file (model instead of controller)