add validation and strong params