params permission also works for nested hashes
bumped version 0.2.0.beta