Polymorphic Update Problem - User has one student

Console Log (Database Query)

Started PATCH "/students/3" for 127.0.0.1 at 2013-10-03 13:10:37 -0700
Processing by StudentsController#update as HTML
  Parameters: {"utf8"=>"✓", "authenticity_token"=>"F/EvSPLZeYtB7lNNsCs8eA/bB3LMjcP+OvKfzBFoFLo=", "student"=>{"case_no"=>"7777", "program"=>"Web Development", "admission_status"=>"", "temporary_password"=>"[FILTERED]", "admission_date(1i)"=>"2013", "admission_date(2i)"=>"10", "admission_date(3i)"=>"3", "admission_date(4i)"=>"15", "admission_date(5i)"=>"27", "user"=>{"name"=>"Travis Glover", "first_name"=>"Trav", "middle_name"=>"L", "last_name"=>"Glover", "email"=>"glovertravis@gmail.com", "password"=>"[FILTERED]", "password_confirmation"=>"[FILTERED]", "social_security_no"=>"654544303", "sex"=>"M", "date_of_birth(1i)"=>"2013", "date_of_birth(2i)"=>"3", "date_of_birth(3i)"=>"13", "street_address"=>"473 W Shaw Ave", "city"=>"Fresno", "state"=>"CA", "postal_code"=>"93704", "home_phone"=>"3333333333", "work_phone"=>"5556667777", "mobile_phone"=>"5557778888", "message_id"=>""}}, "commit"=>"Update Student", "id"=>"3"}
  Student Load (0.1ms)  SELECT "students".* FROM "students" WHERE "students"."id" = ? LIMIT 1  [["id", "3"]]
  User Load (0.2ms)  SELECT "users".* FROM "users" WHERE "users"."loginable_id" = ? AND "users"."loginable_type" = ? ORDER BY "users"."id" ASC LIMIT 1  [["loginable_id", 3], ["loginable_type", "Student"]]
  User Load (0.3ms)  SELECT "users".* FROM "users" WHERE "users"."id" = ? LIMIT 1  [["id", 2]]
Unpermitted parameters: user
   (0.0ms)  begin transaction
   (0.1ms)  commit transaction
   (0.0ms)  begin transaction
   (0.0ms)  rollback transaction
Redirected to http://0.0.0.0:3000/students
Completed 302 Found in 82ms (ActiveRecord: 1.7ms)

edit.html.erb

<%= simple_form_for @student, :html => { :class => 'form-horizontal' } do |f| %>

    <%= f.error_notification %>

    <h4>Student Fields:</h4>

    <%= f.input :case_no %>
    <%= f.input :program %>
    <%= f.input :admission_status %>
    <%= f.input :temporary_password %>
    <%= f.input :admission_date %>

   <%= f.simple_fields_for @user do |u| %>
        <h4>User Fields:</h4>
        <%= u.input :name%>
        <%= u.input :first_name %>
        <%= u.input :middle_name %>
        <%= u.input :last_name %>
        <%= u.input :email %>
        <%= u.input :password %>
        <%= u.input :password_confirmation %>
        <%= u.input :social_security_no %>
        <%= u.input :sex %>
        <%= u.input :date_of_birth, input_html: { class: 'datepicker', id: 'dp1', }  %>
        <%= u.input :street_address %>
        <%= u.input :city %>
        <%= u.input :state %>
        <%= u.input :postal_code %>
        <%= u.input :home_phone, as: :tel %>
        <%= u.input :work_phone %>
        <%= u.input :mobile_phone %>
        <%= u.input :message_id, label: 'Epitomax Message ID' %>

    <% end %>

    <%= f.error :base %>
    <%= f.submit nil, :class => 'btn btn-primary' %>

<% end %>

students_controller

class StudentsController < ApplicationController

  def create
    @student = Student.new(student_params)
    @user = User.new(user_params)
    @student.save!
    @user.loginable = @student
    @user.save!
    redirect_to root_url
  end

  def new
    @student = Student.new
    @user = @student.build_user
  end

  def edit

    @student = Student.find(params[:id])
    @user = @student.user

  end

 def update
    #authorize! :update, @student, :message => 'Not authorized as an administrator.'
    @student = Student.find(params[:id])

    @id = @student.user.id
    @user = User.find(@id)

    if @student.update(student_params) && @user.update(user_params)
      redirect_to students_path, :notice => "Student updated."
    else
      redirect_to students_path, :alert => "Unable to update student."

    end
  end

  def index

    @students = User.where(loginable_type: 'Student').includes(:loginable)

  end


  private

  def student_params
    params.require(:student).permit(:case_no, :program, :admission_status, :temporary_password, :admission_date, user_attributes: [:email, :password, :password, :name, :first_name, :middle_name, :last_name, :social_security_no, :sex, :date_of_birth, :street_address, :city, :state, :postal_code, :home_phone, :work_phone, :mobile_phone, :message_id, :password_confirmation ])
    #params.require(:student).permit!
  end
  def user_params
    params[:student][:user].permit(:email, :password, :password, :name, :first_name, :middle_name, :last_name, :social_security_no, :sex, :date_of_birth, :street_address, :city, :state, :postal_code, :home_phone, :work_phone, :mobile_phone, :message_id, :password_confirmation)
    #params[:student][:user].permit!
  end

end