making always permitted params configurable