removed attr accessible completely from user model