Make nested attributes act as create_or_update

Since :without_protection has been removed from Rails in an effort to move security away from the model, we should allow creation of nested attributes, both when an ID is omitted and when it is present.