:warning: ```attr_accessible``` was disabled! :warning: This means all our models were mass assignable, so if anyone crafted a post request in a certain way (lets say, by adding is_admin = true to their user create form) I'm fairly certain the app wouldn't complain at all. This is a doozie -- and must be fixed.