Avoid mass-assignment issues! Allow controller to save payment attrs.