Often a model is touched by several controllers, e.g. a dedicated /admin controller. Right now strong params are only injected in the root controller