Oauth controller, User permitted_params