Объркване на масовото присвояване в асоциацията на релсите

Имате проблеми с нещо, за което съм сигурен, че е основно, но също така имате проблеми с намирането на добър отговор тук на SO.

Имам таблица Users и таблица Authorization, ето моите модели:

##Authorization.rb
class Authorization < ActiveRecord::Base
  attr_accessible :provider, :uid, :user_id
  belongs_to :user
  validates :provider, :uid, :presence => true


  def self.find(auth_hash)
    find_by_provider_and_uid(auth_hash["provider"],
                             auth_hash["uid"])
  end

  def self.create_with_hash(auth_hash)
    #if they've already registered, then just return that authorization

    unless auth = find_by_provider_and_uid(auth_hash["provider"],
                                           auth_hash["uid"])
      user = User.create(name: auth_hash["info"]["name"],
                         email: auth_hash["info"]["email"],
                         nickname: nil,
                         firstname: auth_hash["info"]["first_name"],
                         location: auth_hash["user_location"]
                         )

      auth = create(user: user,
                    provider: auth_hash["provider"],
                    uid: auth_hash["uid"])
    end

    auth
  end

end

И моят потребителски модел:

##User.rb
require 'bcrypt'

class User < ActiveRecord::Base
  include BCrypt

  #accessible and settable properties
  attr_accessible  :name, :email, :nickname, :firstname, :location

  #relations
  has_many :authorizations, dependent: :destroy

  #validations
  validates :name, :email, :firstname,  :presence => true
  validates :email, :uniqueness => true
  validates :nickname, :uniqueness => true

  #always make sure their email and nickname are lowercased
  def before_validation(user)
    user.email.downcase!
    user.email = Password.create(email)
    user.nickname.downcase!
  end

  def after_save(user)
    user.email = Password.new(user.email)
  end

  def is_nickname_available?(nickname)
    Users.find_by_nickname(nickname.downcase).blank?
  end

  def add_nickname(user_id, nickname)
    #todo: error handling
    user = Users.find(user_id).update_attribute(nickname: nickname)
  end

  def add_provider(auth_hash)
    #Check if the provider already exists, so we don't add it twice
    unless
      authorizations.find_by_provider_and_uid(auth_hash["provider"],
                                              auth_hash["uid"])
      Authorization.create    user_id:self.id,
        provider: auth_hash["provider"],
        uid: auth_hash["uid"]
    end
  end

end

В контролер, ако се опитам да направя: Authorization.create_with_hash(auth_hash), получавам грешката:

Can't mass-assign protected attributes: user

На ред auth = create(user: user, provider: auth_hash["provider"], uid: auth_hash["uid"]) в моя модел Authorization.rb.

Така че, аз съм много нов в това, но не ми е ясно защо това не работи. Може ли някой да обясни какво правя погрешно?

Благодаря Мустафа