Create two sub-objects in a nested form?

In my rails app, I am creating an object "Organization" and two sub-objects "User" and "Settings" in a nested form. When I run the form I get the error:

WARNING: Can't mass-assign protected attributes: user

I had previously had this problem on another project and discovered I needed the

@organization.users.build

in organizations_controller/new. In order to have the sub-objected added to and create a a sub-object on submittal of the form.

organization.rb
class Organization < ActiveRecord::Base
  attr_accessible :org_name, :address1, :address2, :city, :state, :postal_code, :country, :logo_image, :setting_id, :active, :status_image, :users_attributes, :setting_attributes
  has_many :users, :dependent => :destroy
  has_one :setting, :dependent => :destroy
  accepts_nested_attributes_for :users
  accepts_nested_attributes_for :setting
end

user.rb
class User < ActiveRecord::Base
  attr_accessible :email, :password, :password_confirmation, :name_first, :name_last, :admin, :notes, :current_outstanding, :pin, :registered, :sms, :super_user, :organization_id

  belongs_to :organization
end

setting.rb
class Setting < ActiveRecord::Base
  attr_accessible :green_hours, :green_mins, :yellow_hours, :yellow_mins, :red_hours,   :red_mins, :reminder_sms, :reminder_sms_hours, :reminder_sms_mins, :logo_url, :comp_name, :alert_emails, :alert_smss, :history_hours, :time_zone, :user_id, :organization_id

  belongs_to :organization
end

organizations_controller.rb
class OrganizationsController < ApplicationController

  def new
    @organization = Organization.new
    @organization.build_setting
    @organization.users.build

    respond_to do |format|
      format.html { render :layout => 'application_dashboard_orgs' }
      format.json { render json: @organization }
    end
  end

  def create
    @organization = Organization.new(params[:organization])

    respond_to do |format|
      if @organization.save
        format.html { redirect_to organizations_path, notice: 'Organization was successfully created.' }
        format.json { render json: @organization, status: :created, location: @organization }
      else
        format.html { render action: "new" }
        format.json { render json: @organization.errors, status: :unprocessable_entity }
      end
    end
  end
end

organizations/_form.html.erb
<%= form_for(@organization) do |f| %>
  <div class="Col1">

  <div class="MenuItem"><div class="MenuItemLabel">Account Name:</div> <%= f.text_field :org_name %></div>
  <div class="MenuItem"><div class="MenuItemLabel">Address Line 1:</div> <%= f.text_field :address1 %></div>
  <div class="MenuItem"><div class="MenuItemLabel">Address Line 2:</div> <%= f.text_field :address2 %></div>
  <div class="MenuItem"><div class="MenuItemLabel">City:</div> <%= f.text_field :city %></div>
  <div class="MenuItem"><div class="MenuItemLabel">State:</div> <%= f.text_field :state %></div>
  <div class="MenuItem"><div class="MenuItemLabel">Postal Code:</div> <%= f.text_field :postal_code %></div>
  <div class="MenuItem"><div class="MenuItemLabel">Country:</div> <%= f.text_field :country %></div>
  <div class="MenuItem"><div class="MenuItemLabel">Logo Image:</div> <%= f.file_field :logo_image %></div>
  <div class="MenuItem"><div class="MenuItemLabel">Active Account?</div> <%= f.check_box :active %></div>
  </div>

<div class="Col2">
  <div class="MenuItem"><div class="MenuItemLabel"><b>Administrator Account</b></div></div>
  <%= f.fields_for :user do |user| %>
      <div class="MenuItem"><div class="MenuItemLabel">First Name:</div> <%= user.text_field :name_first %></div>
      <div class="MenuItem"><div class="MenuItemLabel">Last Name:</div> <%= user.text_field :name_last  %></div>
      <div class="MenuItem"><div class="MenuItemLabel">Email Address:</div><%= user.text_field :email  %></div>
      <div class="MenuItem"><div class="MenuItemLabel">PIN:</div><%= user.password_field :password, :id => "password_field", :onchange => "add_pin()" %></div>
      <div class="MenuItem"><div class="MenuItemLabel">PIN Confirmation:</div><%= user.password_field :password_confirmation  %>  </div>
      <div class="MenuItem"><div class="MenuItemLabel">SMS Reminder Phone #:</div><%= user.text_field :sms  %>  </div>

      <div class="MenuItem"><div class="MenuItemLabel">Is Administrator:</div> <%= user.check_box :admin, {checked: true} %></div>
      <div class="MenuItem"><div class="MenuItemLabel">Password Setup?</div> <%= user.check_box :registered   %></div>
  <% end %>
  <%= f.fields_for :setting do |setting| %>
      <%= setting.hidden_field :green_hours, :value => params[99] %>
      <%= setting.hidden_field :green_mins, :value => params[59] %>
      <%= setting.hidden_field :yellow_hours, :value => params[0] %>
      <%= setting.hidden_field :yellow_mins, :value => params[15] %>
      <%= setting.hidden_field :red_hours, :value => params[0] %>
      <%= setting.hidden_field :red_mins, :value => params[0] %>
      <%= setting.hidden_field :reminder_sms, :value => params[true] %>
      <%= setting.hidden_field :reminder_sms_hours, :value => params[0] %>
      <%= setting.hidden_field :reminder_sms_mins, :value => params[15] %>
      <%= setting.hidden_field :history_hours, :value => params[24] %>
  <% end %>
      <div class="MenuItem">
    <%= flash[:notice] %> <br />
    <%= f.submit "Save Settings" %> <!--<input type="reset" value="Reset" />  -->

  </div>

  <div class="clr"></div>

</div>