permitted_params as public method in controller