This is a potential security vulnerability. When receiving user input, you should whitelist the input you receive. The gem 'strong_parameters' (https://github.com/rails/strong_parameters) which I included in the Gemfile provides support for whitelisting params.

Instead of `params[:user]` here you would use `user_params = params.require(:user).permit(:email)` so that only the 'email' key of the hash is passed in to User.new.

This is actually not a problem now because the user only has an email address, but consider the case where we had the following model:

```lang=ruby
class User
   attr_accessible :email, :is_admin
end
```

and in the controller created new users via `User.new(params[:user])`. A malicious user could pass in additional parameters to a request such that `params[:user] == { :email => 'myemail@test.com', :is_admin => true }` and get admin privileges on the site.