add allowed_params as the intersection between read and write allowed params