replace attr_accessible with params.require