converts hashes in arrays of unfiltered params to unpermitted params [closes #185, closes #159]