Never treat action or controller as unpermitted params