attr_accessible breaks mass_assignment_security