Maybe we should explicitly whitelist allowed attributes here to prevent mass assignment.