Use before_save instead of before_validation


Ensures that update_attribute xss terminates
fields.