title: Rails 4.1.5 omniauth strong parameters
body: <p>After upgrading Rails 4.1.4 to 4.1.5 i get errors with my facebook omniauth session everything was working fine since then.
  When i create a User Session i get an <code>ActiveModel::ForbiddenAttributesError</code></p>
  
  <p>Route:</p>
  
  <pre><code>  match 'auth/:provider/callback', to: 'sessions#create', as: 'signin', via: :get
  </code></pre>
  
  <p>Session#create controller:</p>
  
  <pre><code>  def create
          user = User.from_omniauth(env["omniauth.auth"])
          session[:user_id] = user.id 
          session[:user_name] = user.name
  
        redirect_to root_path
    end
  </code></pre>
  
  <p>and a user model like this:</p>
  
  <pre><code>  def self.from_omniauth(auth)
      where(auth.slice(:provider, :uid)).first_or_create.tap do |user|
        user.provider ||= auth.provider 
        user.uid = auth.uid
        user.name = auth.info.name
        user.save
      end
    end
  </code></pre>
  
  <p>I can bypass the ActiveModel error by adding a permit! method in my User Model like that:</p>
  
  <pre><code>where(auth.slice(:provider, :uid).permit!).first_or_create.tap do |user|
  </code></pre>
  
  <p>But it override the first user from the database...
  The <code>session[:user_id]</code> seems to always be the first User from the database.</p>
  
  <p>I don't know if it's a strong parameters problem, an Omniauth problem or both?</p>