update_attributes expects a hash, duh