do not re-permit manually permitted params