Be explicit about whitelisting URL params

-- @alexmuller and @gtrogers