问has_secure_password的问题

EN

class User < ActiveRecord::Base
  attr_accessible :username, :email, :full_name, :password_digest
  has_secure_password
end

@user = User.new({
  username: params[:user][:username],
  password: params[:user][:password],
  password_confirmation: params[:user][:password_confirmation],
  email: params[:user][:email],
  full_name: params[:user][:full_name]
})

# I even tried with `@user.new(params[:user])`

Can't mass-assign protected attributes: password, password_confirmation