This won't catch uses of params[:member] or params[:members]. Better to move allowed role validation into the base class, and let subclasses override which roles are allowed