Rails 3 - Devise nested form giving mass assignment error

I know this has been covered a few time on here but I cant seem to solve this error -

WARNING: Can't mass-assign protected attributes: new_order_attribu开发者_运维百科tes

This is the nested hash that is trying to be saved -

Parameters: {"utf8"=>"✓","authenticity_token"=>"UNKZf7zvlyReHSCbMRRl+9y+F5/2YF8Rf64Wm9O9xyo=", "user"=>{ "new_orders_attributes"=>[{"plan_id"=>"2", "price_id"=>"2222"}], "first_name"=>"Alex", "last_name"=>"Handley", "email"=>"alex@s.co.uk", "job_title"=>"Programmer",  "password"=>"[FILTERED]", "password_confirmation"=>"[FILTERED]"}}

The user data is saved but the order is not saved.

Models

User

devise :database_authenticatable,
     :recoverable, :rememberable, :trackable, :validatable

attr_accessible :email, :password, :password_confirmation, :remember_me, :name, :location, :country, :job_title, :company, :parent_id,:first_name,:last_name,:subscription_type, 
:orders, :plan_id, :user_id, :price_id

has_many :orders
has_many :plans, :through => :orders
accepts_nested_attributes_for :orders, :plans

Orders

class Order < ActiveRecord::Base
 belongs_to :plan
 belongs_to :user
end

Plans

 has_many :orders
 has_many :users, :through => :orders

Rails -v - 3.0.3

Nested Form

  <% prefix = "user[new_orders_attributes][]" %>
  <%= fields_for prefix, @user.orders do |order_form| %>
   <%= order_form.hidden_field :plan_id, :value => 2 %>
   <%= order_form.hidden_field :price_id, :value => 2222 %>
  <% end %>

Thanks, Alex

Try adding orders_attributes to the attribute list in the attr_accessible statement.