I would expect safe=true to mean that this set() call is 'safe' and should not respect protected attributes.