oops, need to use params.permit here