attempt to support protected_attributes (legacy attr whitelisting)