forgot about rails 4 param permission