Rails 4 seem to allow setting the id through supplied parameters
The controllers ported to strong_parameters should guard against
attacks over this vector, but I didn't want to remove the specs
that test this here