set application.rb config.active_record.whitelist_attributes = false for mass assignment