Fix PermittedParams not filtering auth_source_id and fix specs