fixed 'mass-assign protected attributes' problem