Do we need to add ```_user``` to the blacklisted params for Fireplace?