move the permit to a seperate model
changed the controller to use application method
hide the fields do not have access
finished 371 strong parameters
Merge pull request #282 from fireweb/master

Finished 317 strong parameter