I don't think we should force users to set the controller action in development if they don't want to. Well placed documentation could save hours and many lines of code that are subject to change when a dependency updates. I'd say submit an issue to IR on the unpermitted form params (if it's even their library that's causing it), and let the documentation describe new things to watch out for with strong parameters.