url added to strong parameters in upload