That's a good catch. I think it would be better to normalize the
protected_attributes array into strings, and force the attribute to a
string as well. That way, you can call it with symbols or strings,
and it doesn't matter which type you used in your model definition.
Someone submitted a patch a while ago to account for attr_accessible
as well, which I think got lost in the shuffle somewhere. It may
still be in lighthouse.
Tammer