Added test to ensure User.admin is not attr_accessible