User params are already drifting out of sync. DRY up the permit call in the controller