protect :password, :salt attributes