made user_params a private method