add allow method on hash to prevent illegal params
validation on tour
add hash method allow to restrict params