fix can't mass assign protected attributes and now tests pass