fix mass-assign protected attributes