Mass-Assignment

Registration passed the whole form straight into the user insert, so adding is_admin to the request created an admin account.