Getting attributes in nested model rails 3.2

I have two models user and profile.
I want to save the username and password in user and other user profile details in profile.
Now,
The user model has:

has_one :profile
accepts_nested_attributes_for :profile
attr_accessible :email, :password,:profile_attributes

The profile model has

 belongs_to :user
 attr_accessible :firstname, :lastname

The user controller has

 def new
    @user = User.new
    @profileattr = @user.build_profile
  end

  def create
    @user = User.new(params[:user])

    if @user.save
      redirect_to root_url, :notice => "user created successfully!"
    else
      render "new"
    end
  end

The view new.html.erb have fields for both user and profile.
view has:

<%= form_for @user do |f| %>
  <% if @user.errors.any? %>
    <div class="error_messages">
      <h2>Form is invalid</h2>
      <ul>
        <% for message in @user.errors.full_messages %>
          <li><%= message %></li>
        <% end %>

      </ul>
    </div>
  <% end %>


  <p>
    <%= f.label :email %><br />
    <%= f.text_field :email %>
  </p>
  <p>
    <%= f.label :password %><br />
    <%= f.password_field :password %>
  </p>


  <%= f.fields_for @profileattr do |pf|%>
  <p>
    <%= pf.label :firstname %><br />
    <%= pf.text_field :firstname %>
  </p>
  <p>
    <%= pf.label :lastname %><br />
    <%= pf.text_field :lastname %>
  </p>
  <% end %>

  <p class="button"><%= f.submit %></p>
<% end %>

However,when I run this web application it shows error:

Can't mass-assign protected attributes: profile

on debug I found the user has attributes as:

 :email:abc@gmail.com
 :password:secret

 :profile
            ---:firstname:abc
            ---:lastname:xyz

so,instead of expected params[:profile_attributes] the view returning params[:profile]
leading to mass-assignment error.so what is going wrong?

Did you try

  <%= f.fields_for :profile do |pf|%>

?