add permit params for nested attributes