get rid of home-grown allow_params in favor of using strong_parameters gem, ala rails 4