add better errors, binding of caller; add unpermitted params raise to env; add category_id to permitted params, add category to form