Fix unpermitted params on puts and posts