add protected attributes for rails 4; fix a spec that appears to have been a mistake