omniauth-facebook yields ActiveModel::ForbiddenAttributesError in omniauth_callbacks_controller.rb:84:in `assign_provider_attrs'

Nobody has claimed this yet.

Using latest master commit:
`gem "devise_token_auth", git: "https://github.com/lynndylanhurley/devise_token_auth", ref: "2a5cedbbd886329a318298d15b38fabbee51e7da"`

After successfully calling /auth/facebook, logging in, and being redirected to /auth/facebook/callback, I receive the following error:
`ActiveModel::ForbiddenAttributesError in DeviseTokenAuth::OmniauthCallbacksController#omniauth_success`

After doing some debugging I was able to trace the origin of the error to this part of the omniauth_controller:
```
From: /usr/local/rvm/gems/ruby-2.4.1/bundler/gems/devise_token_auth-2a5cedbbd886/app/controllers/devise_token_auth/omniauth_callbacks_controller.rb @ line 82 DeviseTokenAuth::OmniauthCallbacksController#assign_provider_attrs:

81: def assign_provider_attrs(user, auth_hash)
=> 82: binding.remote_pry
83: attrs = auth_hash['info'].slice(*user.attributes.keys)
84: user.assign_attributes(attrs)
85: end

[1] pry(#)> attrs = auth_hash['info'].slice(*user.attributes.keys)
=> {"image"=>
"http://graph.facebook.com/v2.6/REDACTED/picture",
"email"=>"blitzkev@gmail.com"}
[2] pry(#)> attrs.permitted?
=> false
```

Do I need to explicitly permit image and email on user somewhere? I feel like I'm missing an important configuration step.

Start in app/controllers/devise_token_auth/omniauth_callbacks_controller.rb at assign_provider_attrs, then reproduce the /auth/facebook callback described in the issue. Determine why the sliced auth attributes are rejected during assignment; done means Facebook login completes without ActiveModel::ForbiddenAttributesError.

Written by the indexing model from the issue text.