Can you add some comments that describe what's going on with `application_params` and `user_params`, as well as the `require` and `permit` calls?