We should actually be creating an authentications table or something which has a relationship to user. I initially thought that since this is a 1 to 1 relationship it would be fine on the table, but leaving it on users means exposing provider_id and provider as attr_accessible :(.