permit password param on sign in

without this, I'm seeing:

Unpermitted parameters: password