learning question : can this use permitted params?  I notice comment_attributes exists