Removed user from the attr_assessible in user.rb for security reasons