that's correct, but we can actually restrict it in the model level by setting "attr_accessible"