Also, it's not possible to reach a category that isn't in the permitted list (see `config/routes.rb` for details). We're fixing the `params[:category]` to the defaults in there, so it's protected twice - once in code, once in routes.