adding test to make sure the user cannot be mass assigned