Use PermittedAttributes in other controllers as well

Help users extend it better
Set promotion specs as pending for now, fix other specs