missed a require for protected_attributes