added private method for params.permit