converted rails 3 => 4 security, removed protected_attr gem