removed protected attributes, added strong params