allow permitted_params to be a private method

The examples in the strong_parameters README show a private method
for parameter sanitization.  This tiny change allows for following
that pattern.