A workaround for using cancan with strong_parameters, as suggested by AntonTrapp and JiriKolarik in this issue: https://github.com/ryanb/cancan/issues/835#issuecomment-20229737

ApplicationController.rb

before_filter do
  resource = controller_path.singularize.gsub('/', '_').to_sym
  method = "#{resource}_params"
  params[resource] &&= send(method) if respond_to?(method, true)
end

NoteController.rb

def note_params
  params.require(:note).permit(:what, :ever)
end