upgrade to rails 4 - use strong parameters