Handling parameters properly.

Read them from $_GET/$_POST instead of $_REQUEST, and read only the ones
we want. This prevents users setting $_SESSION and other globals by hand.