use the `permit_params` DSL everywhere
#3147: raise error for those still using `default_actions`