require protected_attributes
fixed script