receive image only
fix create
receive params from outside
rm product_params
add csrf protect
add product_params
add two kind