Fix doc for `permitted_params`

`permitted_params` returns params that contains the resource name as its root key.

Such as:
``` ruby
  {
    'post' => {
      'title' => 'Rails is omakase.',
      'author' => 'DHH'
    }
  }
```
Merge pull request #3199 from tricknotes/fix-doc-for-permitted_params

Fix doc for `permitted_params`
Apply decorator to CSV export; fixes #3198