change routes to use slug, fix strong params