removed array response hack; made array return values in REST controllers more secure