[#1167066] fix users controller permitted params