title: Alternative to mass assignment for HABTM
body: <p>I have a similar situation to this <a href="https://stackoverflow.com/questions/755774/activerecord-fails-to-update-habtm-relation">question</a>, which was already posted. Koraktor has asked </p>
  
  <blockquote>
    <p>I'm using a simple model for user authorisation with two ActiveRecords User and Role User and Role have a HABTM relation to each other.
    .
    .
    Manually assigning roles with @user.roles or @user.role_ids works, but not the "magic" inside User#new or User#update_attributes.</p>
  </blockquote>
  
  <p>Oleg suggested that </p>
  
  <pre><code>attr_accessible :role_ids
  </code></pre>
  
  <p>be added to the user model.  This would allow mass assignment operators to update roles. However, he cautioned against using this approach because of security concerns.</p>
  
  <p>I have a follow up question to Oleg's response - </p>
  
  <p>In this situation, is there a recommended method to update roles without using mass-assignment?  </p>
  
  <p>Also, assuming </p>
  
  <ol>
  <li>you authenticate users, </li>
  <li>only allow administrators to CRUD users by putting a before_filter in the users_controller, </li>
  </ol>
  
  <p>is mass-assignment of role_ids still a valid concern?</p>