permitting all user params -- DANGEROUS living