do not require protected_attributes