I'd use `params.slice(ALLOWED_PARAMS)` instead.