ActiveRecord::AssociationsAssociationCollection.load_target doesn't respect protected attributes

load_target uses mass assignment, which means that protected attributes don't get updated with their correct db values during the merging process. What's worse, this is a silent failure (except for a log warning depending on the env) so it's really tricky to track down.

This patch provides a test case and a fix.