strong parameters, book is wrong again, I knew it!