changed update_attributes to update in all controllers
patched vulnerability