permitted params bug