This was brought up in #9995, but is only present in 3-2-stable, since
mass assignment is removed from Rails 4.