:user_id shouldn't be a permitted parameter