working around a declarative_authorization bug dealing with strong parameters.