Allow `notes` in `permitted_params()`