Passing unfiltered params directly to update or update_attributes allows mass assignment.
Filter params through strong parameters before passing them to update.