use strongish params, show a flash message and errors
lock down to my codeception