move permitted params to controller