Remove attr_protected on User now that we use strong_parameters