Drop `attr_accessible` for rails 4

If used in the controller it needs to be permitted