Use attr_accessible instead of attr_protected

This is a well known best practice and in the light of security vulnerability in `attr_protected` discovered recently (https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/AFBKNY7VSH8) I think it is good to state this explititely in guidelines.