title: Can't mass-assign protected attributes: user
body: <p>I have a sign-up form that uses a nested model. Client can have multiple users, and a <code>User</code> belongs to a <code>Client</code>. On the sign-up form, I want to be able to register both a client and user at the same time. However, I keep getting the "can't mass-assign" for user, which I don't understand since I have <code>accepts_nested_attributes_for :users</code>.  </p>
  
  <pre><code>&lt;h1&gt;Sign Up&lt;/h1&gt;
  &lt;%= form_for @client do |client_form| %&gt;
    &lt;% if @client.errors.any? %&gt;
      &lt;div class="error_messages"&gt;
        &lt;h2&gt;Form is invalid&lt;/h2&gt;
        &lt;ul&gt;
          &lt;% for message in @client.errors.full_messages %&gt;
            &lt;li&gt;&lt;%= message %&gt;&lt;/li&gt;
          &lt;% end %&gt;
        &lt;/ul&gt;
      &lt;/div&gt;
    &lt;% end %&gt;
    &lt;div class="field"&gt;
      &lt;%= client_form.label :business_name %&gt;
      &lt;%= client_form.text_field :business_name %&gt;
    &lt;/div&gt;
  
  
      &lt;%= client_form.fields_for :user do |user_form| %&gt;  
        &lt;div class="field"&gt;
          &lt;%= user_form.label :first_name %&gt;
          &lt;%= user_form.text_field :first_name %&gt;
        &lt;/div&gt;
        &lt;/div&gt;
          &lt;div class="field"&gt;
          &lt;%= user_form.label :last_name %&gt;
          &lt;%= user_form.text_field :last_name %&gt;
        &lt;/div&gt;  
        &lt;div class="field"&gt;
          &lt;%= user_form.label :username %&gt;
          &lt;%= user_form.text_field :username %&gt;
        &lt;/div&gt;
        &lt;div class="field"&gt;
          &lt;%= user_form.label :password %&gt;
          &lt;%= user_form.password_field :password %&gt;
        &lt;/div&gt;
        &lt;div class="field"&gt;
          &lt;%= user_form.label :password_confirmation %&gt;
          &lt;%= user_form.password_field :password_confirmation %&gt;
        &lt;/div&gt;
      &lt;% end %&gt; 
  
    &lt;div class="actions"&gt;&lt;%= client_form.submit %&gt;&lt;/div&gt;
  &lt;% end %&gt;
  
  
    class Client &lt; ActiveRecord::Base
  
    attr_accessible :business_name
    attr_accessible :users_attributes
  
    has_many :users
    has_many :items
  
    accepts_nested_attributes_for :users, allow_destroy: true
  
    ...
    end
  
    class User &lt; ActiveRecord::Base
    attr_accessible :client_id, :first_name, :last_name, :username, :password, :password_confirmation
    belongs_to :client
  
    has_secure_password
    ....
    end
  </code></pre>
  
  <p><strong>ERROR</strong></p>
  
  <pre><code>ActiveModel::MassAssignmentSecurity::Error - Can't mass-assign protected attributes: user:
    (gem) activemodel-3.2.11/lib/active_model/mass_assignment_security/sanitizer.rb:48:in `process_removed_attributes'
    (gem) activemodel-3.2.11/lib/active_model/mass_assignment_security/sanitizer.rb:20:in `debug_protected_attribute_removal'
    (gem) activemodel-3.2.11/lib/active_model/mass_assignment_security/sanitizer.rb:12:in `sanitize'
    (gem) activemodel-3.2.11/lib/active_model/mass_assignment_security.rb:230:in `sanitize_for_mass_assignment'
    (gem) activerecord-3.2.11/lib/active_record/attribute_assignment.rb:75:in `assign_attributes'
    (gem) activerecord-3.2.11/lib/active_record/base.rb:497:in `initialize'
    app/controllers/clients_controller.rb:45:in `new'
    app/controllers/clients_controller.rb:45:in `create'
    (gem) actionpack-3.2.11/lib/action_controller/metal/implicit_render.rb:4:in `send_action'
    (gem) actionpack-3.2.11/lib/abstract_controller/base.rb:167:in `process_action'
    (gem) actionpack-3.2.11/lib/action_controller/metal/rendering.rb:10:in `process_action'
    (gem) actionpack-3.2.11/lib/abstract_controller/callbacks.rb:18:in `block in process_action'
    (gem) activesupport-3.2.11/lib/active_support/callbacks.rb:414:in `_run__330478543754893527__process_action__2034132490286778675
  __callbacks'
  </code></pre>
  
  <p>What's wrong here? </p>