title: Rails 3: role_mask won't save - WARNING: Can't mass-assign protected attributes: roles
body: <p>I'm using the code from Railscasts 189 to implement roles with Devise so I can use Cancan.  However the roles are not being saved to the role_mask field.  Relevant code from my user model:</p>
  
  <pre><code>  attr_accessible :email, :password, :password_confirmation, :remember_me,
                    :name, :about, :awards, :url, :roles_mask
  
    ROLES = %w[admin support worker monitor visitor]
  
    named_scope :with_role, lambda { |role| {:conditions =&gt; "roles_mask &amp; #{2**ROLES.index(role.to_s)} &gt; 0"} }
  
    def roles=(roles)
      self.roles_mask = (roles &amp; ROLES).map { |r| 2**ROLES.index(r) }.sum
    end
  
    def roles
      ROLES.reject { |r| ((roles_mask || 0) &amp; 2**ROLES.index(r)).zero? }
    end
  
    def role_symbols
      roles.map(&amp;:to_sym)
    end
  </code></pre>
  
  <p>In the views for user "new" and "edit" I have the following to show checkboxes for the roles:</p>
  
  <pre><code>  &lt;p&gt;
    &lt;%= f.label :roles %&gt;&lt;br /&gt;
    &lt;% for role in User::ROLES %&gt;
      &lt;%= check_box_tag "user[roles][]", role, @user.roles.include?(role) %&gt;
      &lt;%=h role.humanize %&gt;&lt;br /&gt;
    &lt;% end %&gt;
    &lt;%= hidden_field_tag "user[roles][]", "" %&gt;
    &lt;/p&gt;
  </code></pre>
  
  <p>When I check the check boxes for a couple of the roles and hit "submit", I get the following flash:
  1 error prohibited this user from being saved:</p>
  
  <p>And I get the following error from the server:
  WARNING: Can't mass-assign protected attributes: roles</p>
  
  <p>I've checked the DB and nothing gets saved in the roles_mask field.  There are lots of questions in Stackoverflow about "can't mass-assign protected attributes" but they don't seem germane to this situation.</p>
  
  <p>Any suggestions?</p>