Testing nested strong parameters in Devise registration controller

I have generated a User model (using devise) having an associated profile model.

app/models/user.rb

class User < ActiveRecord::Base
  has_one :profile
  devise :database_authenticatable, :registerable, :recoverable, :rememberable, :trackable, :validatable
  accepts_nested_attributes_for :profile
end

User attributes for purpose of registration are email, password, and password_confirmation. Profile attributes are username, first_name, last_name, and bio.

I have generated custom controllers and I am trying to test registration controller, my issues is that registration controller test is not failing when it should.

test/controllers/users/registrations_controller_test.rb

class Users::RegistrationsControllerTest < ActionController::TestCase 
  setup do
    @request.env["devise.mapping"] = Devise.mappings[:user]
  end

  test "nested strong parameters" do
    assert_difference('User.count', 1) do
      assert_difference('Profile.count', 1) do
        post :create, user: { email: 'id@email.com', password: 'password', password_confirmation: 'password', 
                              profile_attributes: { username: 'una', first_name: 'first', last_name: 'last', bio: 'Bio of una' } }
      end
    end

    assert_response :redirect
  end
end

app/controllers/users/registrations_controller.rb

class Users::RegistrationsController < Devise::RegistrationsController 
  before_filter :configure_sign_up_params, only: [:create]

  def create
    super
  end

  protected
  def configure_sign_up_params
    devise_parameter_sanitizer.for(:sign_up) { |u| u.permit(:email, :password, 
        :password_confirmation, profile_attributes: [:username, :first_name, :last_name]) }
  end
end

Herein I am passing bio attribute which is not a permitted parameter, but test is still getting passed.

I will request you to help me understand why this test is not failing.