added attr_accessible to user model