fix cancan strong parameter issue on post