support strong parameteters via permitted_params method