converts hashes in arrays of unfiltered params to unpermitted params [fixes #13382]