ruby on rails - Password being removed from parameters in my controller despite being allowed -

in kidscontroller have

def kid_params   params.require(:kid).permit(:firstname,                               :lastname,                               :gender,                               :pseudo,                               :birthdate,                               :avatar,                               :password,                               :longitude,                               :latitude,                               :parent_id) end 

while kid defined follow:

class kid < activerecord::base   has_secure_password end 

however when try post json create new kid, password cannot blank error.

the log shows:

started post "/kids" 127.0.0.1 @ 2015-05-12 14:28:34 +0900 processing kidscontroller#create html parameters: {"firstname"=>"testpaw", "lastname"=>"qwdqwd", "password"=>"[filtered]", "kid"=>{"firstname"=>"testpaw", "lastname"=>"qwdqwd"}}

but once actual create method, parameters have been reduced {"firstname":"testpaw","lastname":"qwdqwd"}

what filtering password parameters? creating kid rails console works fine...

in current setup, password filtered because not part of kid namespace. if should part of kid namespace, need change in view.