use permit_params! it is defined
implement a default not_authorized method
bump version