Added password to permitted params