Put responsibility for protecting attributes into the UserController