test: accept ID change by mass assignment by default

If you don't want to accept ID change by mass assignment, use
"permitted?" interface. It is ForbiddenAttributesProtection way.

It is an incompatible change but it is OK because it is Active Record
4 style.