..Of course you need to whitelist additional params in production. wtf???