handle UnpermittedParameters as bad request

Should we rescue UnpermittedParameters the same way as ParameterMissing? It is cleaner to return as bad request with a meaningful response body rather than raise error in the system.

It shines when you try to build API for services using strong parameters.