bypass mass assignment from rails