fix allowed params in workouts controller