only let through defined request parameters