Attributes security fix

One commit from Spree and an additional similar one of our own.