Fix controller permitted parameters