posts_controller#post_params: permit! -> permit

Security fix.