title: password param not being included in strong params
body: <p>I'm using Bcrypt with has_secure_password in my User class, and trying to create a new User with username and password, but the password param, although permitted in my strong params, is not coming through.</p>
  
  <p>This is my User class:</p>
  
  <pre><code>class User &lt; ApplicationRecord
    has_secure_password
  
    has_many :journals
  end
  </code></pre>
  
  <p>This is the User Controller:</p>
  
  <pre><code>class Api::V1::UsersController &lt; ActionController::API
    def index
      @users = User.all
      render json: @users.to_json(:include =&gt; :journals)
    end
  
    def create
      byebug
      @user = User.create(user_params)
    end
  
    private
  
    def user_params
      params.require(:user).permit(:username, :password)
    end
  end
  </code></pre>
  
  <p>I'm trying to post a new user with:</p>
  
  <pre><code>fetch('http://localhost:3001/api/v1/users', {
  method: 'POST', 
  headers: {Accept: 'application/json', "Content-Type": 
  'application/json'}, 
  body: JSON.stringify({username: 'Name', password: 'test'})})
  </code></pre>
  
  <p>and the result, inside the byebug in 'create', is:</p>
  
  <pre><code>(byebug) params
  &lt;ActionController::Parameters {"username"=&gt;"Name", "password"=&gt;"test", 
  "controller"=&gt;"api/v1/users", "action"=&gt;"create", "user"=&gt; . 
  {"username"=&gt;"Name"}} permitted: false&gt;
  (byebug) user_params
  &lt;ActionController::Parameters {"username"=&gt;"Name"} permitted: true&gt; 
  </code></pre>
  
  <p>No matter what I try, I cannot access the password param in user_params to create a user with a hashed password. </p>
  
  <p>In terminal, in rails console, I can create a user and the password gets hashed as expected, I can then fetch that user information from the API with a normal fetch request, but I cannot use strong params to create a User with a Post request, and I don't know why. </p>