allow :all to be provided to a whitelist. remove require_any_param