params should be readonly in the controller