diff --git a/app/assets/javascripts/angularjs/admin_sessions.js.coffee b/app/assets/javascripts/angularjs/admin_sessions.js.coffee
index 2b17a22..0c63fcd 100644
--- a/app/assets/javascripts/angularjs/admin_sessions.js.coffee
+++ b/app/assets/javascripts/angularjs/admin_sessions.js.coffee
@@ -5,7 +5,7 @@
     $http
       url: url
       method: 'POST'
-      params:
+      data:
         username: $scope.username
         password: $scope.password
     .success (res)->
diff --git a/config/application.rb b/config/application.rb
index b3c8bc0..4b2d6a7 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -17,6 +17,8 @@ module WBlog
     config.time_zone = 'Beijing'
     config.action_controller.action_on_unpermitted_parameters = :log
 
+    config.filter_parameters += [ :password ]
+
     # generators
     config.generators.assets = false
     config.generators.helper = false