added config.active_record.whitelist_attributes = false to allow old behaviour of explicitly using attr_accessible