remove allowed_attributes as it does not work this way