btw: can we not allow_mass_assignment for now? (I assume you can define the atts we allow?)