important security fixes

now it's not allowed to mass-assign state and published_at fields for advertisement