Add permitted params to app controller