Wouldn't it be better to include ActiveModel::ForbiddenAttributesProtection in every model now?