Make the primary key not accessible.

Letting the primary key be set through mass assignment can allow some
interesting problems when application logic forgets to handle ACLs
properly.
Fix mistakes when generating $_accessible

The property needs to be a hash, not a list.