work on security in allowed_fields_spec.rb