Remove permitted_attributes from the admin

The default resource controller handles it fine, which works since we no
longer have the STI