additional_permitted_attributes moved to config