fix user registration bag with permitted params