Some security: removed foreign keys from mass assignment

Also defined relationships in models