If this is an admin controller I think we can just go ahead and `params.permit!`. We only care about restricting parameters tightly on the frontend. We trust admins to behave :)