move the permit to a seperate model
changed the controller to use application method
hide the fields do not have access
finished 371 strong parameters