updated permissions for attributes for rails 4