removing user_id from the permitted parameters