added permits for params in app_contr