title: Rails 4, make attribute inaccessible
body: <p>previous rails 4 I had in a model </p>
  
  <pre><code>class User &lt; ActiveRecord::Base
    attr_accessible :name, :email, :password, :password_confirmation
  
    ...
  end
  </code></pre>
  
  <p>But now <code>strong_parameters</code> replaced the <code>protected_attributes</code> so I comment it and use <code>permit</code>.</p>
  
  <p>Now I discovered that I can access attribute without permitting it.</p>
  
  <p>In <code>rails c</code> I manage to do this:</p>
  
  <pre><code>2.0.0p247 :002 &gt;   User.new(admin: "1")
   =&gt; #&lt;User id: nil, name: nil, email: nil, created_at: nil, updated_at: nil, password_digest: nil, remember_token: nil, admin: true&gt; 
  
  2.0.0p247 :016 &gt;   user = User.new(name: 'Nir', email: 'nir@example.com', password: 'foobar', password_confirmation: 'foobar', admin: "1")
   =&gt; #&lt;User id: nil, name: "Nir", email: "nir@example.com", created_at: nil, updated_at: nil, password_digest: "$2a$10$xVnY8ydd5SoaLVipK5j4Del40FrOmu4bKypGjBEwvms7...", remember_token: nil, admin: true&gt;
  </code></pre>
  
  <p>When obviously I should not be able to set and change the admin attribute. Only <code>user.toggle(:admin)</code> should be able to.</p>
  
  <p>So what am I not understanding or should do right.
  And how to make this test pass:</p>
  
  <pre><code>  describe "accessible attributes" do
      it "should not have allow access to admin" do
        expect do
          User.new(admin: "1")
        end.to raise_error(ActiveModel::MassAssignmentSecurity::Error)
      end
    end
  </code></pre>