fixed secure params bug on controller
fixed secure params bug on controller