When strong_parameters had been included, this case of update became possible

This test passes against 3.2 but fails against master.
`[:id, :type]` were protected by default by sanitaizer, but now they aren't.

Actually we have to include `id` column in `permit` when we use `accepts_nested_attributes`.

Do we have to do something with it guys?