use permitted params for auth_source
add changelog entry
Merge pull request #830 from opf/fix/use_permitted_params_for_auth_source

use permitted params for auth_source