passed hash with strong parameters; removed permit(bang)