title: Rails 4: accepts_nested_attributes_for and mass assignment
body: <p>I am trying to reproduce <a href="http://railscasts.com/episodes/196-nested-model-form-part-1">railscast #196</a> in Rails 4. However, I'm experiencing some problems.</p>
  
  <p>In my example I try to generate a Phonebook - each Person could have multiple PhoneNumbers</p>
  
  <p>These are important parts of my controller:</p>
  
  <pre><code>class PeopleController &lt; ApplicationController
      def new
          @person = Person.new
          3.times{ @person.phones.build }
      end
  
      def create
          @person = Person.create(person_params)
          @person.phones.build(params[:person][:phones])
  
          redirect_to people_path
      end
  
  private
  
      def person_params
          params.require(:person).permit(:id, :name, phones_attributes: [ :id, :number ])
      end
  end
  </code></pre>
  
  <p>and this is my new view</p>
  
  <pre><code>&lt;h1&gt;New Person&lt;/h1&gt;
  
  &lt;%= form_for :person, url: people_path do |f| %&gt;
      &lt;p&gt;
          &lt;%= f.label :name %&gt; &lt;/ br&gt;
          &lt;%= f.text_field :name %&gt;
      &lt;/p&gt;
  
      &lt;%= f.fields_for :phones do |f_num| %&gt;
          &lt;p&gt;
              &lt;%= f_num.label :number %&gt; &lt;/ br&gt;
              &lt;%= f_num.text_field :number %&gt;
          &lt;/p&gt;
      &lt;% end %&gt;
  
      &lt;p&gt;
          &lt;%= f.submit %&gt;
      &lt;/p&gt;
  &lt;% end %&gt;
  </code></pre>
  
  <p>needless to say i have <code>has_many :phones</code> and <code>accepts_nested_attributes_for :phones</code> in the my person model and <code>belongs_to :person</code> in the phone model.</p>
  
  <p>I have the following issues:</p>
  
  <ol>
  <li>Instead of 3 phone-number-fields there is just one in the new form</li>
  <li>When I submit the form I get an error: </li>
  </ol>
  
  <blockquote>
    <p>ActiveModel::ForbiddenAttributesError</p>
  </blockquote>
  
  <p>in the line</p>
  
  <pre><code>@person.phones.build(params[:person][:phones])
  </code></pre>
  
  <p>Parameters:</p>
  
  <pre><code>{"utf8"=&gt;"✓",
   "authenticity_token"=&gt;"l229r46mS3PCi2J1VqZ73ocMP+Ogi/yuYGUCMu7gmMw=",
   "person"=&gt;{"name"=&gt;"the_name",
   "phones"=&gt;{"number"=&gt;"12345"}},
   "commit"=&gt;"Save Person"}
  </code></pre>
  
  <p>In principle I would like to do this whole thing as a form object, but I think if I don't even get it with accepts_nested_attributes, I have no chance to do it as a form object :(</p>