Use strong parameters properly to set allowed world fields
Finish applying permit to controllers to fix tests