Add attr_accessible to user.rb