this is dangerous! If I know I can set the `user_id` through mass assignment I could potentially impersonate another user. You're not mass assigning the user in the create action so permitting this attribute is probably unnecesary