Does `permitted_params` need to be defined somewhere?