None of these should be accessible except user. You don't expose the rest via mass assignment parameters anywhere.