add attr_accessible to has_many association